Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-12-2024 21:03
General
-
Target
3e85eb8fc0c497b88234e25268f664fd74cd9ad82c6211f591fb930044a352ff.exe
-
Size
218KB
-
MD5
cdbb07b5d36b902e9e807847c0915fd3
-
SHA1
51aa02173d3fb66f9ce7a8e488af9657159b039d
-
SHA256
3e85eb8fc0c497b88234e25268f664fd74cd9ad82c6211f591fb930044a352ff
-
SHA512
72c588513288fd531c06de876bdffd1392391f6a4886faae83bb2e533d5a28b41bc21c28dc3c7a669b44ba594f987d976e0fb544963129189d62b08f5e7865d0
-
SSDEEP
3072:Ovm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2HO:Q1SyAJp6rjn1gOObn4b6h97
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e85eb8fc0c497b88234e25268f664fd74cd9ad82c6211f591fb930044a352ff.exe"C:\Users\Admin\AppData\Local\Temp\3e85eb8fc0c497b88234e25268f664fd74cd9ad82c6211f591fb930044a352ff.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52f4e26ab18b6e7d65d58c0ab35a40037
SHA13be858be22ad31f9887ecbfa32cac0cb5d252dbb
SHA25615ff2e2e3c06a780665a3ffd9d6b77a0a589d49977d5fa72364d2a5f4af746aa
SHA512cd7414e3c80f7e7bc2a3fc399ae4e5864273a978473ab86162201bfae6ba45a5313b55786dcde006ccf6e904858c01a9b17507df4cbe3289fec958c378271f20
-
Filesize
218KB
MD5775a3099ed7c78f7ed4c232cbea0cfd6
SHA146da8fd88d205561c50e7de913d69b8c2cd70754
SHA25638771b735fe0650839b0d2da10892d386275791e39b2b7f82d8d965b005cc179
SHA512d51437215699319603e6400443f677b90ab2556181ac943d152f99252a1767927a2999708ce983bd174ca712a6002ebbc7c887b8149d8586987db8d3a0fa3148
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB