Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-12-2024 20:05
General
-
Target
b88ed10ae95066643a0669b07afa0af3f8dde206e48af16b7fd4035ee8a0d7c4.exe
-
Size
201KB
-
MD5
a3d687fa9689a7fd5c70160c13fa3d0d
-
SHA1
ef3cc5d3ae239590755fafe3d7a8e59f3bc8a71b
-
SHA256
b88ed10ae95066643a0669b07afa0af3f8dde206e48af16b7fd4035ee8a0d7c4
-
SHA512
fc4d0c5171b5cba9c60c65c61612bef50b976b1c3e940d4ef4af226f52188350f77b544a8a9d624b08e33244edba18bb017195ad25e025d1ac3963ccd1885f6d
-
SSDEEP
6144:gt++Jbojf5Vq5OC4qZhZcKYhc/ZfUozYM:j+cff22qZhZcKYhc/3
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Program Files directory 34 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b88ed10ae95066643a0669b07afa0af3f8dde206e48af16b7fd4035ee8a0d7c4.exe"C:\Users\Admin\AppData\Local\Temp\b88ed10ae95066643a0669b07afa0af3f8dde206e48af16b7fd4035ee8a0d7c4.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD54fe5cfc1095e49ccf7ad67dc0b5c9e71
SHA10a4d212d31e9ef2f371fed586b9db8e0ce811161
SHA2565a41e76a49e2451cb37aa5e99b3e0480d1012a9f6af478342db0e9ad33f7a028
SHA512ca7dc9b26e1d0c029144b20522af7091179932a0e8417cd7241f43aba28ceee3c4f34bd783b31bc0b362714a964700cb38315a3f792a9e45e94aa478f67e9909
-
Filesize
61KB
MD58b198842c28e8518916d8d36b2291cfe
SHA13e27a91776de93ed3c5bd54556f6739ffa9056e3
SHA256aeb5bd057981711af34ef5d930a80624386762178e83f56bc83cf82139d227b4
SHA5127f336b61e09f9312e8e25f646b74e8ebc76615cd58135ebc4c2b4c044800a3b1a36afb5a79caf6d19bbdc47da5e9bdd851668bacd5ce8208582ff4cb644a6d4e
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD56df82068384b14bad542ac122c4d995c
SHA1e1545893016de171794955cf04250dae1076bed8
SHA2564409f9695e3d037e4897602af4f01e4fd8e840f50d21a1657934b2261872e666
SHA512248eceb5fa76141ea6ab6dc0fc05582678cfe1362d073ac142f5ab99b5abeb6210d1c895430ba1cd686ac10628f29f1332b1da769c1d96f420c1deaabf0edf6c
-
Filesize
1KB
MD53651c29233fae28b42c2dece4176b298
SHA1a77380535ce1c01db997eeef48a232597a52826b
SHA2563e5421d836bb3723c9109255343008bd0e3cb169de8f4be7debb2325c7e1ee55
SHA512bab35ddd0b84bead3a94764e3177c1e8478ed0faa83c91bf68f00a415ce507c4dc578266429e674accd617991a26b52bfee6d8f22e8ba91fef0846aaaff27c6f
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
201KB
MD5b1440a67be10b8b6d978dcd4e19a8c3e
SHA1be341eeff3a1b0400baaa56e29aa1072eeb8c459
SHA256a8655cafb97153430f0c387a3d9047aae58dcf3fb0bd728b4edb57ae6f18b0e0
SHA51261b5a3f87f9707f037e0465959ec1507b1aa8d79c089803d40b17fdf8efa0cff8b4d61ff42f8326175f6d58ca2b659c634a60807e427b8c1d47300fcbcbf8895
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
656KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
316KB
-
Filesize
368KB
-
Filesize
316KB
-
Filesize
368KB
-
Filesize
580KB