Analysis
-
max time kernel
113s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/12/2024, 05:51
General
-
Target
5fcc54f24bc9d816124647969960d8fc77864f2f664b4fd57340eaceb962ac27N.exe
-
Size
711KB
-
MD5
cb9be790acd6cb3c57049783556374d0
-
SHA1
907a2ccb34a68cdfcc42ad6a23857c221eb799ed
-
SHA256
5fcc54f24bc9d816124647969960d8fc77864f2f664b4fd57340eaceb962ac27
-
SHA512
4b0df2648c570f8203dc3ba37a8fae72c814501df8727191858f88073cf5246d2f66969956c2c35a049341b2852650e073bef5c81df1b2ad3fe35595cc6e7019
-
SSDEEP
12288:YmWhND9yJz+b1FcMLmp2ATTSsdsmWhND9yJz+b1FcMLmp2ATTSsdS:YmUNJyJqb1FcMap2ATT5qmUNJyJqb1FB
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fcc54f24bc9d816124647969960d8fc77864f2f664b4fd57340eaceb962ac27N.exe"C:\Users\Admin\AppData\Local\Temp\5fcc54f24bc9d816124647969960d8fc77864f2f664b4fd57340eaceb962ac27N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53bd3c96b40defeed1367404762c4977f
SHA182280d70316a71992e762f0cc834a941c7d96172
SHA2564e4eeed9809ad1db2d2386ea01be464770b902d97a5e7452b78390711d58d720
SHA51294f4d974cae534ccd15ae370335b1527d633d3334237ccfe98592b8934a6794c2922181fc90dcc5e4130d3dbc364ff941ed98620fd84c4247929d9bde84b04e7
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD592515908191027bfc8124c0e2e3b8144
SHA15b4a790b4798db5641b0b72b9bd1abbd68dfefbe
SHA256bcc412b21d1a2673ce1119cbf5b06d7fca3dab1edb1538382c0ede19abd72d63
SHA5121bdc3dba68799be77373bb2b1a09e5e7b0a8d3e8fc61318d7c74b13017b68c1c13190ab9d847ec438d0d788abef73d64558f5277f799211cabfc14f8c8643a1e
-
Filesize
42KB
MD5cd5967cf38f21f3297cc873f484c3bf4
SHA16bc994aa747266da7a1c7d9a46af0cb328ec4987
SHA25631a09fc5e39e52bd83fd8e98a0c85dc78ae05b26cbfb0f95358f5711398de8e0
SHA512a87b1c2f8f48811607f11d5acc797a32fa7a287eab6cfd0e72b6b1eb10d255215266bc10ac56e7a7cd84b908fcccc01cc545a57168111d38502efa2dc5ae77f2
-
Filesize
42KB
MD55c5dec022c86cbe0ba1f5bacfd9e2ecb
SHA1bdc0701dec0a18558bb264615bfc702ad7d6deab
SHA256a15c245bce4cbcc1d9d8cd0e6166c154c96d60a016cf61205d4ed6cc24e5bc5e
SHA5122f256af2eea25c8734a6fc174b36a11ca4db51cac728596669ca13193076ac8aa0fd362feb02916c893e28bc24b8329b758b37a729125bbfd3e23170d8925ade
-
Filesize
711KB
MD57ed0c0ce239f26a3d8340816d9154c54
SHA103cb1088ed5970e982a41ffbd274b97530d0b0d6
SHA256aed9b933a5b494d457f34f804aaad39011ad2d108af06179f6d452b715107764
SHA512baca615f0b2d18307b701280dfa0ebfd98b927ec9f91413ad09ba749913e791ae6e27525cc9c80ca8bd5637d91f052892080adb367d33d44af1c81848b1631bd
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB