Analysis
-
max time kernel
110s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 21:54
General
-
Target
9f5a2270f9a9813011714b042f822edbf0de50d0dfc9117636b76ab100e4b890.exe
-
Size
218KB
-
MD5
64a301ea296a161ae103f5014257a668
-
SHA1
ee18d0e4347ff337e188925e2f2e41c0fdab437b
-
SHA256
9f5a2270f9a9813011714b042f822edbf0de50d0dfc9117636b76ab100e4b890
-
SHA512
718ea249a55483d049d3788a97b1ba49e59d28ba66cc8e75ca617985be1af4c9b0bc186f160a66a22a82519480586d20fce7eec95cf1d051a9bebdf4b52c1381
-
SSDEEP
3072:dvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Hu:R1SyAJp6rjn1gOObn4b6h9r
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f5a2270f9a9813011714b042f822edbf0de50d0dfc9117636b76ab100e4b890.exe"C:\Users\Admin\AppData\Local\Temp\9f5a2270f9a9813011714b042f822edbf0de50d0dfc9117636b76ab100e4b890.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD54973a9c447b73b6769ec657d0d2e4fb3
SHA1042852034d399f8790242c8e1f3ea8f5d63d9ed6
SHA25630e870c85b86fef67317843eee6311a6038e979da9a5c67146681a9c4f559323
SHA512c2f9893eae52e01f649ea35fa22db94826a2c2e8febbfd9d92d9ce941ae234f4e1d6c052910aeacfd15e1d802edbb1827a036bf2be7b39c223403a8ee13cdc51
-
Filesize
1KB
MD52f1bbe5c6453a09788fa6446f45fc7de
SHA1a8e3f93362693f81af186b756542d2afb6f1e623
SHA2561ddc818c966219d618f50680a404e6275a9da88a715353bfc77ebf378cc7c8d1
SHA5120eb25bab747b2c945fcd22ba696936bee97c09c58e53ddfb714b5265804321fa1239d1c26f00c5da4076ec7f45c302ddfecdea127bf4232bfd01dbad2ddc5824
-
Filesize
42KB
MD5a0855547ab4337373f48bd8ce87b16f8
SHA1c5716d3d28addd74a5a20b2267de4d4e0f7044e3
SHA256f39722143ee6e6e4ab0d9885cfb6056f44974f5f152a15277a7d156546bce83f
SHA5125b27cb04111f1d2ccd895d87202151acb9a6722d3128f73b1b32edcaa548a08384272a81ec1f6a05a8d32f43a3f8fef54192b860d57f6f30d6834e02c7280393
-
Filesize
218KB
MD51e448e7538ab82ed28746aed87cf56a4
SHA1267d595eeccaa66480d43e33de5b79722b33e254
SHA2564762100c0ae0e338f3146f8ef14e5d5b64919a0a2fe276956e779c5df35dfe48
SHA512d3ddbd7e68472d88104035bf089f179b7e4482e9ce071bb31f3c8b3003d3f29a53be4d9644b3cc0160f19775f12821afcb678574e6967e9accbe9b3b88f10b44
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB