Analysis
-
max time kernel
110s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16/12/2024, 13:53
General
-
Target
d6cd3cc7b53ffd5c45a7bb9353dd7e07a063723845b17f5292ed8e8d1f4a93d2N.exe
-
Size
208KB
-
MD5
d7c67f08176c8178a88eae31d34783d0
-
SHA1
c44c5ca6b0b2ad507e3cb3b038ed61eb1322c640
-
SHA256
d6cd3cc7b53ffd5c45a7bb9353dd7e07a063723845b17f5292ed8e8d1f4a93d2
-
SHA512
67cc24b8ef13ac92152ab9edae066d0f4a221cd9ee6f973011edcd3c254e423f5dff893abccab058de3e5eb6af4799627442f802b6d39d5a02e18ee687d8ecc0
-
SSDEEP
6144:8a1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkQ:8bapK0JCmRcU9vVokfr
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6cd3cc7b53ffd5c45a7bb9353dd7e07a063723845b17f5292ed8e8d1f4a93d2N.exe"C:\Users\Admin\AppData\Local\Temp\d6cd3cc7b53ffd5c45a7bb9353dd7e07a063723845b17f5292ed8e8d1f4a93d2N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
24KB
MD5e1891dfa98c2f9670a8b9110fcb8402f
SHA1d8dbd58465a722e7998051ebfe34825afea4d61a
SHA256bdaffa8f9e9046afc1bf46be0c9a841981be3eb7b092b3c874f1c7df446c6370
SHA51285962db7a909d115afa902b3067bf0b6ad94ca2a9defec62654c154f6e0a836b8b76c620bc5f3cfad09299259bd658e595a709d6da0558693ed8df8374419893
-
Filesize
1KB
MD51e1d0df98899f9a1479a899b3465f84e
SHA1f64f884ccff1f4407fb6bb5a00d1c01827eb6f02
SHA2566427a9628499e8816f2896e3a896c34e2a985ee4383d2fcc2d2ecaa1111ca58b
SHA512d3d4d1e7380e0ae0a8b8a953b3a73520bbf7069088f700198290bb7569e458cb6037b5944aa6869784af1d77b69baf2ee2bee6c17e08a8dee3f63d24d672aec5
-
Filesize
42KB
MD5ab9a55eda4f4dc0fd1463290b4e02152
SHA1ec066533b78bf40f53bc34fead0bbcb204af82b0
SHA256df3310e09b8981e89490a2e4cc54edbee31b680d6bcb16df81a79aa81ee1e1cb
SHA512c39747bfe32342a8051204de95202766b86d1f6af3978e3dd59875ab08e2d8d519f855c8f9b15e6c12c0e08f711729550d32a94022b5fe1fa3ea1c567522d253
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD520b271417cac54d97b15bf83cd60f6ee
SHA1954c7a692515d4965d252613a82901a7c52f3ac1
SHA256ad03bb2ac03e0ca483cb865f3901f0bbbe2f9ebcd71d479ce9357e3999ce1d82
SHA51231f399fa9aef16f9f0910cff48ebe720b50c324815e2d594092a72a6b438398fd945e462bd8558a6bd2ed6dbaaa9466d9efa075dd5d9a8b48b30bc384efbfba8
-
Filesize
208KB
MD51d8d1e901ade9af1d6a87e076658e038
SHA1d287a9588464f25e4579a7be341a23acc0fe22a7
SHA2568685f9f53875744944702cfde4ff04846106ec3b296b472ea5d54dd568a02d79
SHA51208fe24faa52ce83bf33e72e73bf0d9a9852fe5b59d819ef7809723fdd666bbed85b3743b2e86ee52650014489e183b6fc1a2c4e5708359640a7bcdf61b34b7f3
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
412KB
-
Filesize
12KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB