Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-12-2024 23:42
General
-
Target
ccedcb0874cdfedc68b3f3c828d744c26d23926af45efeef73508b61d79064feN.exe
-
Size
204KB
-
MD5
81fec5c76ce8ef51be4f893b16907c80
-
SHA1
792c2b37e7f9fd0902349759b747183a9e0e2ee0
-
SHA256
ccedcb0874cdfedc68b3f3c828d744c26d23926af45efeef73508b61d79064fe
-
SHA512
aac22ab33c00a2527721009456628edb9f53ef82f98a947710c68429b895ae3812d204fa50c9a99afe297a6519a5bab05914ee12869bca96e7c2cac3b23de655
-
SSDEEP
3072:U5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:ULexkuRaX41xoyJV65gzyZko+uch
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccedcb0874cdfedc68b3f3c828d744c26d23926af45efeef73508b61d79064feN.exe"C:\Users\Admin\AppData\Local\Temp\ccedcb0874cdfedc68b3f3c828d744c26d23926af45efeef73508b61d79064feN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD594f960d203a1d7cf914e30ff6408f6c7
SHA12cb51698ab80d46c029d3d818d59b679dde52873
SHA256c1f9f424af81a1a39e57eb45b1a590f17050049a4f7e79e9655465e22336ef33
SHA512ba8269a1f3bd399f429369747f1877eec4c4e6215b57ccf8ab3cb7c224e02dfb55325e2f13f883f6872f07db4898c0069eea31010d32739156196bb71664feb3
-
Filesize
204KB
MD5a3b04e4bfdd6ac7dd25951238c3a0657
SHA15776403c224622761135c9009f3d345183364bf5
SHA25680611942ce045689f5e4fad2b7c1f81c827f923159a05513542a5e2ecc245958
SHA512eeb17eefd437eeb4f92433179e4aaf8ede8073f0f01d51412a6498526b3c6a32543865dd5b5b85b88a1a7a0190a2900bb4692be97bf3330fac42d70265fddbe6
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB