Analysis
-
max time kernel
111s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-12-2024 06:55
General
-
Target
f53edfa55a5e5ad71588d8a906cd546014f94e3f37fbac06a4abe949f39df31b.exe
-
Size
218KB
-
MD5
95aa08e0f5561be45587f324808d9bc7
-
SHA1
9c475f3d360ae3ab03b64cea965fd46e6abb7ade
-
SHA256
f53edfa55a5e5ad71588d8a906cd546014f94e3f37fbac06a4abe949f39df31b
-
SHA512
eafa57288f216e9a00b603ee6f7d9ec059c2f55332daceffc60db548858e9b6accba9a8784ccf6c6422b11ca48c8eb26f26e6dcee2b2daceeedea21625d4502e
-
SSDEEP
3072:avm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Hq:s1SyAJp6rjn1gOObn4b6h9p
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f53edfa55a5e5ad71588d8a906cd546014f94e3f37fbac06a4abe949f39df31b.exe"C:\Users\Admin\AppData\Local\Temp\f53edfa55a5e5ad71588d8a906cd546014f94e3f37fbac06a4abe949f39df31b.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD53ce32182db210ae0f3dcc24338ee6930
SHA12031611e6c7acd76512901a13b67677b3f1f0c6f
SHA256845e570d5156b1ec7b8747acc08a4ddd9927b8777c0f47589e7bb5d14be9ba37
SHA5120a28e9424402cb09a5d614a96162b9745d11486984faf297cad6dd060525061eceb529944c905d484ac4b5556757281e2ae2eee60ecbedf0440024254e3fbc3c
-
Filesize
1KB
MD555915789328ad929b6296a8dba9cedbd
SHA1cb8e98e766a224ab7f13c9241418ea85f6b49d83
SHA256724100f623fae93e15afd72ea6e3d285230b91fa4b23e65f251bb54809edb5ca
SHA512f9e106390563d8fd3e15fc520e4a1ef65e844e3f411a14d8dc423bce9b7a7e5c3a5666b327118078800699cf48e6c883f20be6c79292984678f68b643b169fa0
-
Filesize
61KB
MD5c5919b49553cf3ac8a5026fd1e50b70a
SHA1a2d985d8b51003849c7674e3805fc8d52b044bdf
SHA25676844c22cd8a4a16dac3c5ab8241f1275d8cbe1a6ea71225b0880782c35d8592
SHA51233e7a25e500f883ce6efc6499b4cd41abcd1e8bfe72a25b5de35db28974a3618087c184af7bbf59d82d5e251624ffbf67371dd012056468a743eda0cb8ba484d
-
Filesize
42KB
MD52cead7ecd350af5ea029fcd2653878b5
SHA1e74a7d5ad0792ce8affd3ebcdf317de5c58f71d1
SHA256f32e5140dadeb2b57f25c17b127a921444ec29f1b15c368029b056a0bb468508
SHA51267ac9caf09c2ef53b8204f97cee73ac9230193012918ab98f6cd59a6c0d92743bfa0835d8e7f33d8cf8879b8d079752500d78ba0f5b33c0a66d832ef99a26164
-
Filesize
218KB
MD521d9282618ab8042e32bf5f5f88c79c4
SHA1ce856251b18cc906573940413a7746ebf7dec487
SHA2568f7c4888578a81788672a1e68cc3d85b6c41b0a22609587412eaaf6a47c79c69
SHA512beb6f51c5b9dc693eaab62afbe23e399036083189378c03f62a563cf86d99f0f759817f316ccbfb25e729433bf7a4531aa61d53926a9852cc5e628e3703b8c74
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB