Analysis
-
max time kernel
120s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 07:47
General
-
Target
dd36257a57081870100f65b2ffdadfa6387d528e005a7a9f9726c35e798c0f41N.exe
-
Size
201KB
-
MD5
f6f54057a46efef67796f19b72357ec0
-
SHA1
a68144da2a56cb7414c0d10514e2a824e2ebd368
-
SHA256
dd36257a57081870100f65b2ffdadfa6387d528e005a7a9f9726c35e798c0f41
-
SHA512
5e64c91060294c2d23454b27e9192a4bf13d8738a0ca596c5c5173f2bead1141158c77105e68503d8a75ea8a9f6c2a4e135e754bafe8be493283e516e5332de4
-
SSDEEP
6144:gt++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:j+cff22qZhZcKYhc/
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Program Files directory 34 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd36257a57081870100f65b2ffdadfa6387d528e005a7a9f9726c35e798c0f41N.exe"C:\Users\Admin\AppData\Local\Temp\dd36257a57081870100f65b2ffdadfa6387d528e005a7a9f9726c35e798c0f41N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
61KB
MD5badbed23594046a73b5dc1854a594d9d
SHA19e413cd1e7a56de6f6f8f54ee22d90ecb2c394c6
SHA256a65b62181f1146b8509e7510f6a687c4fa8a32b2d54f4a41345e9dc82325c3b5
SHA5121da720c68c187670015b899502b1a18c0375ba0ec719f649a0b8129627f420e19673989d8d314c315dded3690f0f1df7d9db0eb2b0d1f30d1548ad190a8851e5
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5f5bc19494439002381b36570e925103f
SHA1978f24bb28fa8d750b7fdfe70eacc49574ef3405
SHA25604ea5017aae603f59911b987e1bbaf85716030137720ef7671e308889fcaf86d
SHA512da609ca60f5a1ba7a392c5f6e5bf444dfd3a0933708a19261eebd73c5c9b024b607c8b42ac60e349eaeaaa2563c277824a86fe3504c24f7818f1862392f230f7
-
Filesize
1KB
MD5ea228512574dc9140740cfc88d6b4df0
SHA158a0c56779bba5fef85ec29e5df470fab43c2f84
SHA256ff8636d11fd63a9a8dc694d42c963085362ae740abc43f05aa1dd9cfcc83bd61
SHA5129fa0b8889fbbe107129723c0670238a77c987e700532ce90efbd5f30dfab3d616080ee7ea58ebc44b8c565e4fe7401b4506a2c0066377d25bda80a6381ced661
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
201KB
MD5be7597754d6d48e588ae31a2c3f8894a
SHA18e111b21453a96d032fd6484c8a78a7108fd23d4
SHA2564f09a67e4fad972d9bf4cf6e0fcd512e5e22062a29d6816877a5dbf5aebbabf4
SHA5124d0b846c672b07813890281123f89bb64404e508daae13c880eaac5b3996e718ff2ceba68f6754a23f8c4f5f3d49b71d73d5d3e8ec8bb35d998201f0cc1264e0
-
Filesize
368KB
-
Filesize
580KB
-
Filesize
368KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
580KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
580KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
656KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
712KB
-
Filesize
712KB