Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 05:43
General
-
Target
a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339.exe
-
Size
218KB
-
MD5
69698cd366448a9e31fd6a68fb9b5d6a
-
SHA1
7592e9b47ac50d1ae40676150d630bde0657a9b8
-
SHA256
a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339
-
SHA512
cfbeb058340bf89755fb15e5e3a59b89394cd872c5f33cbe888b0dcc5b04b7d057cc7e81390d2decf1b10ce4651f9ea7a390136e23329e73109e0feddea010a6
-
SSDEEP
3072:Kvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Ha:c1SyAJp6rjn1gOObn4b6h9R
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339.exe"C:\Users\Admin\AppData\Local\Temp\a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
12KB
MD5e1f035b24ce0e8137682b703d19315b5
SHA118712fd6ad888c146237d187332ccc904ff1f032
SHA256117ea4f0f411e1aaeab307c087a57678abcba7e6aa96a5bd1f2d5d7026d453a0
SHA51217a428fcea9d064e8318f0ef30da88c713209f5d591d2a4e9725d56663acdb96996569693804071aea17ddc793eade219409c4548e48d1ddc8814662236bae7d
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
61KB
MD51f3f7926f24197094906d8b4d836c74c
SHA1c32520b7b2aaff9a211d7698f62f3bc476013e46
SHA256231db81062f4149a09020b05cbd1ab25f90cd6a7f804074dd4f7daefddb1d27d
SHA512ff6b9d643ea06c7fc7cdbb6fcd239721fe0aeadc66a41c3bb3bcb90460b2f1ef2cb02f512c71db407984a1b8fd490982c9447d4c313a021e6021fe26a8b80116
-
Filesize
42KB
MD56aa41ebfded6894d06df5396d2a85c2e
SHA136d62c7182cac2d81f536de0edda224fc8f433ce
SHA256c1bebe0cf1c38096e769734212d99e1a8f39ec18fd3513bb93b3a36fc51fb61f
SHA5121d6b0e9cc86708248aee077640c0531f1969d6c11c65a9fa571a0d99a3d11e5f7e1a2a4744496fa758953f00ae901be2632d80ba2cf61256b563096e29851f7a
-
Filesize
42KB
MD5a402498b1e144cc06353d83a20b7e892
SHA1987b22c65c17c1e20a8ceed107e54b1e0ce661a5
SHA2568eec25767b6be80ebcb73f1c590dee52eba3a929752a3047c9a186036d7c78a0
SHA5127f60e28fe7767c72220ced7b10bdbca34274732aed3de92f6d93a23b6262ba05951709d99b76a58e7c69b7801b6dbbaeba3551d3953642045f0d2888e9019876
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD57464df8b715974763195da4afdc054f1
SHA1f151162db0d7c61b54e5d73ff95fb2ed6495e28a
SHA256dc25d26361c7e014f77642987a09bb4f3e75566ed0091d1e653afb56cedb9f9e
SHA5124a71c2f2851fb7321fcecdf6b60f8ac6758c41a3c4c5c0be3813c2eb82a04170fbfc693dae9d4cee943a123bdfa3edcb5e4155ae597a3d6368211a36bdd41098
-
Filesize
24KB
MD56a6f4a275719ccf50d970ebc0ee45b16
SHA1a49c4e3bb944abfe540fa2d6b4928c653650cf88
SHA25611bddab4faab7523427f051bd500fade534c445db514422182ed037a59c12476
SHA512ef7f651ff2e438585147c7b339d62568a789a3745c5ef95c549d6b075756b5530cabb2994c9dd75a58d3dd0c57916ffbda47b43e1ade15dc4f4756ab21472b42
-
Filesize
1KB
MD569d7a1a5135412da1f4d7227a30999b6
SHA104e6156db65c78c131f3a7d341769f5e9a04ee15
SHA2564b89e45e1f9cce49e686e9d0c40397600f5aee797a7952f36ac8754357f58a54
SHA51248b28fb78f90c15a4f7632105720f186840d4f3c831f44efb88d07c5801b8a593440eaed3289e14783d7944c16995706f49846d5434be4b81cf531b640db8c9a
-
Filesize
218KB
MD5dec95491ca1f46c914c60d35c7889f4a
SHA162d44dc67c0ba6f82b7d8ecafd6f5d3cf3373048
SHA25671caad130f5b7667689c1bea2cb6e4338f9b07cc8a81d3159f544bb7015b92b5
SHA5124e1e94dec95b4abfbd2dcf9fbc33c42c9da05777cf497d0ef87fd308cc7ed8347002f4fc85eae74725cb0a95e8a5846c72bd21f14b0e3bdfe25a0588b94747ac
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB