Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/12/2024, 20:48
General
-
Target
38e1ca030d9bd3babcbe6dc927e4ce69231700a22788b94ea0e42c87f0ffe424N.exe
-
Size
1.0MB
-
MD5
4d3191371f74198e82bb5bfe0bddd7f0
-
SHA1
9b632cb16b07e88724085239c44dadc249b11d10
-
SHA256
38e1ca030d9bd3babcbe6dc927e4ce69231700a22788b94ea0e42c87f0ffe424
-
SHA512
abe73d7fc6bab746d85c0b4ba3c08cd2beef927b5b7f309cc85051ff84072755a7d9c731c6aad3e4f7dc9218c0c2285c0dcb5ca8b9ef74332c9fc7a8ec72be33
-
SSDEEP
24576:PmUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT58:PmV2ApemV2ApemV2Ap8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38e1ca030d9bd3babcbe6dc927e4ce69231700a22788b94ea0e42c87f0ffe424N.exe"C:\Users\Admin\AppData\Local\Temp\38e1ca030d9bd3babcbe6dc927e4ce69231700a22788b94ea0e42c87f0ffe424N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5b829a8b86ab55a8d0148e2ce7db48a13
SHA1ed0365672ae0a2cd504950486ffe964fdee4ee9b
SHA25694646aabc3c10f8ccaf6366ef51366a0a4c41153c66a61c4c51fb609cdfa2589
SHA512d895b77c2d536fbebf7e8222deab3e873bde493a0eb5914cef4bac947589dfba9185931d926e0c796f36b245a97e6255bf0593ed211fafcd62bef6656ab13a27
-
Filesize
1KB
MD5da5bb3430fc1f15126dccb12df055d0a
SHA1e4d283a9679209b0bddfbeec6fadbed82857e18e
SHA256c6cdb1130a07e9b643a09aaf543419833c617e50f73d36df16133eaf7c6efb25
SHA512b23b39482e6a94e0ad287dbdeed38938079ab1ed97b5e368356924abb31484bbf47e92ba273ea6c23c16ba27c35caef2ade9850c04d10763b7ef6828ba19d937
-
Filesize
1.0MB
MD5f17cbe3a9079a497634d2703e9f28f58
SHA19e79b47fb43ce6c1b180e8934608f9477786aaeb
SHA256f6bb8f38c9f93c30fa98225430d2f46ae085023345851ff1a963d0df9d2d5b2d
SHA512a7bc3a2bce2c4790a29ac15257cfd8adba90b715cc643e5692f0776f8fef2616bfdadf4817be7c4b8005dd74a1a267a310eef5985faf54cd399e82661130a356
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB