Analysis
-
max time kernel
111s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/12/2024, 20:29
General
-
Target
ecd21fa83200fe2489c99237a12f15dba3580dfac1339183d71f3c2742b15d4eN.exe
-
Size
218KB
-
MD5
926944274798e5e60a9bd923ec2ea340
-
SHA1
30cdde53c08e70863d3fd7c5ac45414a871c442d
-
SHA256
ecd21fa83200fe2489c99237a12f15dba3580dfac1339183d71f3c2742b15d4e
-
SHA512
bf280e68cb00be713ebb983a958a2563628c063eb60c567b913ede592ea0396879db8130f29bde2ce88b47a2903914ea5272b65d88f5489490af6844cb6dff9c
-
SSDEEP
3072:Uvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:i1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecd21fa83200fe2489c99237a12f15dba3580dfac1339183d71f3c2742b15d4eN.exe"C:\Users\Admin\AppData\Local\Temp\ecd21fa83200fe2489c99237a12f15dba3580dfac1339183d71f3c2742b15d4eN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD525bc25ad8204075af7ffbf39b693146d
SHA1b2399e87574130cfe3e362e95cfe092354e62047
SHA256fbcf48d9af7c4c5a59f29ad93b32f526c3852518c42f8a1fc3e3da4eaba6eb77
SHA51241e19ad60da91108d3e60e798e85afdf7263194fcc8eb03cc03cc0b58474c13c39ae79e3429ff7e41a0c833088f15809b3e911970b0e6b83f0f79619850027b1
-
Filesize
24KB
MD57a038fbb617c55d178fc2d9a1955f424
SHA1f32e6b1609b4d62bb69eaabb509313302314b81d
SHA256ab1ee2ca0722b4ef4605f900ae4be46080bfe6e20f22b981ef6416dc96dc6ae2
SHA51265db2d7ed797d82cedff330fa47947a2c352c0fb46c1bd9d44726f37ed3591284a92bf01fe24ad19531b0b79d3a528e38295ec1982b9dc938aef27a99e838227
-
Filesize
218KB
MD55e53c9e66959d3a9b23934f53916ea5c
SHA1d5ef347ad53404a474f402b9ea5373919eaf5aa6
SHA2566398b728bb86851159fe289b665853098265e57b9b70c422b82aadae7fa69deb
SHA5120dbc89be9d1784ce004b35c47b3f88d100aa71029acb768c012385fbeee3efbe5c056da3e70daad54b9e8e92121b9435bba6356de8b0f53c125e3c074c9cfd71
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB