Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-12-2024 09:13
General
-
Target
d21339abab997bd39fdde7fa0540d06ee8ff0871aacc9acd8f00611fed4015b4N.exe
-
Size
208KB
-
MD5
a1691c7ffc2cb981a70bd59ce5624130
-
SHA1
bf8d2c042963d4356feb2274056b22f5d17316f5
-
SHA256
d21339abab997bd39fdde7fa0540d06ee8ff0871aacc9acd8f00611fed4015b4
-
SHA512
2fb12b2f805f2f0ed23795543f3d0eb6603627b8829167d581035448c9de679b94c52fcf7c1fa85c1c77534dc1cfc1207bdc2e071e7d0e72c14fbe1177961931
-
SSDEEP
6144:ca1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkQ:cbapK0JCmRcU9vVokf7
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d21339abab997bd39fdde7fa0540d06ee8ff0871aacc9acd8f00611fed4015b4N.exe"C:\Users\Admin\AppData\Local\Temp\d21339abab997bd39fdde7fa0540d06ee8ff0871aacc9acd8f00611fed4015b4N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5be4d92f701d3a3046a96a4b839beb22f
SHA1c7f8f0c5c74ccd0106df82a037473fec717d7f30
SHA2565a56f5566b42a77ac3fcb73fc3bf989440b0aa79ba82f121fac18d206c374abf
SHA5124c262d98f24acfe2dbf8efec423919e45a2fda02a7ada201489c679307809915c4237c318b290cc46baa64f85f32fa8f310f4e7d976e2e05a8479c72931c1e6d
-
Filesize
1KB
MD5bea5a3a55fbb73c54047111c22022ba7
SHA1bbb3e3c9d7839605d8166f36c9140cc8a920f434
SHA256219bb0e1cfe28fcc502e034f40a5506f5c079a5ffab8b46c9a188456f0173497
SHA51255e721ecfb0b750d62703eb4773ffd7bacdefff9b6d2d3f188a2b472345cc00f92aef1514605c1c3de9f05cb5ce5b80b35b84574f8d1158ea294fb704d559b73
-
Filesize
208KB
MD58e1451185e8e72253cd9d913edb2f8af
SHA1f5248b3b1ba66de9a984232cc539816be91c6e70
SHA256f5b209932966b2e08d22da8ff27979eb0a17392b8b9543867c7079483918dff5
SHA51287964b9c050f8d75a264e08e2b23b12f658eb060dbbbc38a7e5cc40d1949249941c56a9f1ea0de12216b868b725e9fc9ab3ee9e96b4c44b7ef621171fcf94339
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
412KB