Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 05:34
General
-
Target
ce32533f07eae4281f19313fc0ab3b6de657a9f8825cae94bd5ea01cf004ff68.exe
-
Size
380KB
-
MD5
e77a262da2bc2ec1a9831d5dbfe60cf9
-
SHA1
ffdb883dbbbcd0e4c3c7f1c314f37bb3d5a871be
-
SHA256
ce32533f07eae4281f19313fc0ab3b6de657a9f8825cae94bd5ea01cf004ff68
-
SHA512
22f499088fedafcda5b0c86e6352327b0e0e303ba65f4a7d15a85c42c504ab9a3756ebae74ed31b2d151d757092bd771362f71b9833d1345191d8ef27dd4e908
-
SSDEEP
6144:LaEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiwmryP:jmWhND9yJz+b1FcMLmp2ATTSsdwmryP
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce32533f07eae4281f19313fc0ab3b6de657a9f8825cae94bd5ea01cf004ff68.exe"C:\Users\Admin\AppData\Local\Temp\ce32533f07eae4281f19313fc0ab3b6de657a9f8825cae94bd5ea01cf004ff68.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a0214b7b827b4b50be574f9657b652ab
SHA132bde1b1949ea65a34c68a6fad672abf3b8809b8
SHA256ceea598f88cc085f33ed41e8ea2036db036e79317bcc9d263ced0d76f8fbc775
SHA512d13e60a55f93cd2d2e2d157b37174a39bce6cd36808aed80079fd93005cb8cdcea36fd743c76874972efd0a8d218e9a916948bb5c28bb857f11714a93413940e
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD58ac6014cc2065e9ac7bed9d612019ef0
SHA1d982ee085ae71eb6699a7a50a422ff873fd0ffa8
SHA256b3b7026d5150aa6542d3e7d1c25866a8bad4dac5260da8354da60e2447ac3a81
SHA51230d8782b156c7f3b41f2d58b99a0d1775725903ed0dfc1b77baf8505e222341ac347e339e8a39e714a7763e0f6a97badbb0e6e7ab5f3556249722a1c3e4993f6
-
Filesize
61KB
MD5c23b2b498b34b7cce66f0b0bcbdb1711
SHA10852c4d3de4a8eae9e53b0cce6594f062afcf6e2
SHA2566b479f390e74dbb819a320ae284cc714f22be420652d048e08cb81c9e983e7ec
SHA51220f9385f1ae929b579702e649c34f91977bcf97bfa7fde077c68b92f81ea289a38350a672cd164eaa311ebcf4000213633164249522c68ed083e3c011caf90d4
-
Filesize
1KB
MD5e96346fe978e32faf90f6bb67f969cb5
SHA19e6c362ffda30d35b72647bcb7a3f24568238d93
SHA2567a53594d937fbeeefdfa565045e176907b712b6857fcbcebf7dd19bf165ada07
SHA512e8b993cd10bb4af25fc8ccf603f90c8837b6df2fd8046a8e8f8b250737104c63a7903ad332e217a72f6e9425672f013582c8683bf7380059f7d1a5a050ce1e19
-
Filesize
42KB
MD5d4146efdc92872817933e0d31dc7f64d
SHA15c8e10380e5e8bae0cbba4b1cceda26100ae3ab7
SHA256d57a38c41e32e2f913b0ef6d9685446af0b02783a4c95445cf0abab4a50ad2ce
SHA5120a40d838b9deeda704ce406b85b9a97b433dae5de09f123238e88f87b87685c6cc4435d438f658b7819b019edc4cd5062607393c3cdf810cd75e486981379881
-
Filesize
42KB
MD5a698c1755e46f02b168d1995b0871c26
SHA10e4f68fea8468ac89a7b6321fad4b295ce2da2b3
SHA2566dd82b3a990f1cb8b22393915781f7cd4e149a677c885622e1f76fb04ab9b0c9
SHA512da1003ba3cc3f55c6ee2199ed333da669830a08cbf646d86f22043d3179cbbbfe559a44e7b8b16fb796529da966026540e9a3bb154ec67aade2c32cd5bf2cb8b
-
Filesize
380KB
MD5bcf759634c0fa68d72256c1fa1b22b0f
SHA1d5ed6174d9a1534070d7264364737cbb29fef4ca
SHA256c73d073404d9f7ad1e1deb0917a5c2c28aeaa677ff384a70c88a9b88dc1f1aae
SHA512f012847df05ad306b4e6e2aa1bcd8df8b30e598486b343f80953a4c983ef27d9b45c5a622ae91f76bc9a2325bdf025f28dacea23f6384df84bbf28ca06c8d4bf
-
Filesize
428KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB