Analysis
-
max time kernel
111s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-12-2024 21:23
General
-
Target
afc87222a8a6ab2f6b7ce383d21ece826ac4010c0aea87d0946bc33c2f32c54f.exe
-
Size
218KB
-
MD5
dde3b9a436e9d4720e735678762c0a9e
-
SHA1
a48856866ac183fa4a3d703cce8d4849c6bf0421
-
SHA256
afc87222a8a6ab2f6b7ce383d21ece826ac4010c0aea87d0946bc33c2f32c54f
-
SHA512
d6d339131b43bde1a7cf23d1de11d15b710e242116fa1191b607a3185eccf94b394f855f406e5cc6ccf186c4150995f3539f5f366a6a181e763664ac2b00cd5d
-
SSDEEP
3072:Uvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Ha:i1SyAJp6rjn1gOObn4b6h9x
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\afc87222a8a6ab2f6b7ce383d21ece826ac4010c0aea87d0946bc33c2f32c54f.exe"C:\Users\Admin\AppData\Local\Temp\afc87222a8a6ab2f6b7ce383d21ece826ac4010c0aea87d0946bc33c2f32c54f.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51f00fb5d60549b77defbf0ad770d5149
SHA11a5093b7fce5d6011c785531ca4e3498c0386d97
SHA256d567d5bba56081f160e20dc5fa3a35b89738402f137c87340edf1d95f99b98fa
SHA51249cda8a6460bccca61528d7bdaffffefcbd2cb51c0628992bda0d0d8315f832427fbc9df1892b8d6c7feaddf2cb4dbc8e11e085a5e26f74598641372cf7c89c3
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD51c757cf395804b85491ac770b559f323
SHA104683656a8828ec5f320213524aa5834532c0819
SHA2565062d958da006fd7a718a355b70cb78d56c7e8e8c0d80aab7f248985f4762781
SHA512c03fdf5d9abc379dd9ba323ae3d72b5fcdbfee7cb9aef7c87f5a772db1056e732f4e5a096d726308b404f6c3cdada4001a647a98e0cb3e3a99f5131b1b8fbd87
-
Filesize
42KB
MD53c37e95507ee065357fdf2e3aad3547b
SHA18d58a6182d22c89aeceb50767b1d052098e21c82
SHA256d1ad1d04f869ddbc23cd76029c16055820e9f34789495862b4dacc3344df6c55
SHA512d21e558cb56f8994cc7ca79b732616a82106a53e6b15930b764defa58a8864c7f9de1fde7d93a69bd9760bbe1c76f85fde8ee430eb7b1f51029c5bcace97d032
-
Filesize
42KB
MD52b6336218d8d3d405596bf0112f6ef70
SHA1563b7dd2cbbdf012d28d350d8c289266527b2741
SHA25634d3293b844a02fd988d00719c1bc0c9146be19384103e4892207ae0823e815f
SHA5126345b2bda8bb492de34b8043ade3942fce94efbf74ca8dcdda5217490e24a715067ede8115796b581a01f79005b4001218d72d6ff81d4e252ce558a30bd1285f
-
Filesize
218KB
MD50484f863e153fc317d3010a36f249686
SHA121de564c490e7b7961c6d47bfa90104b568988ef
SHA256753bb50870136f55e09c2588033fa8cfe615857d243b40da16388d60ed95f7d1
SHA5126f5c2288b9e6d5104367211127caf2856b31802325f193d7746f008cc024c5bd973097d87fc15c31875483d71a931b588c1628c1f5f869bbb0a593e4e84ece26
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB