Analysis
-
max time kernel
111s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-12-2024 05:55
General
-
Target
c9612984e07c835d8208b3515f21cd26f0ac94c6cdf0665e57e532f01f30a718N.exe
-
Size
218KB
-
MD5
76cb989c53f194cbb1445545f89cb630
-
SHA1
73dad85a0d8a7850cd8f25ec89de781e38c5b151
-
SHA256
c9612984e07c835d8208b3515f21cd26f0ac94c6cdf0665e57e532f01f30a718
-
SHA512
fd82b04d11cacbab849c919543dbde32c866ec4ff1ac29a5ead9b644e14d8e27906e2ac42cf97c00ce6a919a0e51621a62e163e7fd95a079b6b7e6f57126577b
-
SSDEEP
3072:hvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Hq:l1SyAJp6rjn1gOObn4b6h9p
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9612984e07c835d8208b3515f21cd26f0ac94c6cdf0665e57e532f01f30a718N.exe"C:\Users\Admin\AppData\Local\Temp\c9612984e07c835d8208b3515f21cd26f0ac94c6cdf0665e57e532f01f30a718N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5ce0a66317ef8b862f71ec729a9c23b47
SHA184773c874fb8d547060f93976882172d699098d2
SHA25664e1f3f19ac2b7b016ad3dd208b452325781f3c76830dce0303ddbac6fe44fb4
SHA512d93f459f8977e436093897d7d435e035daa73d35c5149755aff1a7fcdb485eb8e6c3369cf112216f192237c8d448485768ed90ef3ae6291b058d2fbd87a43400
-
Filesize
61KB
MD5277ccd9027c9efd0c011a2776bda2eb6
SHA1933dc796cb772fc2e37c7b616125e8929326cdd2
SHA256dcd29243609da2d326a5b8506fabd09627e533406e23414654882782ea719ab9
SHA5127a237ef934a7812bd82e96ff30b37b21ea889117104f400288292c98f201084c0710a385b9702143ec45fdc82631b1ba8a8fc9862df131e57c30c0ea8447c5fd
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5eeb2b7200e6648c44d70eaf673b60465
SHA11f22738b60b3a1783d0c1d5271b087db6992d37e
SHA2567825c7193c64a2bc663afd2c802815bbff8f5f944363c36eef9501c58cb6e3f1
SHA51282e87c515fa06dce5d5b8cfe2e44f663996164a7c3d42d8ee4471d5585aefa44846724bdd0c9047947d020da4af7ef5c5aef411186063cd2e6906ac9686a4df7
-
Filesize
42KB
MD527bea3d80c33928bca31f956719231d3
SHA1e20be82757c8c3888a0389a090f579a959e931ed
SHA256d7c66deeb1f91cd60b177728173a3d87a1f6d630a71a428aa0c464feb1c33ffd
SHA512d5c2c59e58bf093f6ffdb73cc4f49c560c008dbb5d084648d2422f42d33eaedf6fdbc0e1c3f454c8e012a386cfb2cadfd16dcddbffbc2d688fb7a7be7e008a58
-
Filesize
1KB
MD52c8b0c6af7846d4502e6dec6dc123cf9
SHA1a3bbb42a39f35cf38fcf3445591a0491cacefa30
SHA256af5c49334149dde051d039ee2285a3c26a6abda2671c4d87a2506a74fca377f8
SHA512b07b050111f32b75d37643c9509487a8328426b122223629a9b44da9e6a9bbd6fd53a9907743c29dd224c0555dbd1c551f1e39226809d5d19fefece67b3da131
-
Filesize
218KB
MD5091de235da6b64713b37b2f6c9323a41
SHA1abe6c18ca5c7350627d08fc125c651d6c89bb38b
SHA2562fd1e3d2db4cb7c513f3d6f5c080e392a26e0250d367c2ce4947e38cd3df632f
SHA5125e6a411f70a16da3d652679d2dd8a038a79c6f6e5daa5e391c3bc4c0b5d580e86bd4bb1f13b63e32c88f9058684b84da5b7e15a9106ded97e2488995ab807a9a
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB