Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 08:05
General
-
Target
b0381a0d28f9df56cc921782013ff41650d197901e0ede79d7bb7513738e6854N.exe
-
Size
218KB
-
MD5
41c5151023c437587617afb2f4884ce0
-
SHA1
8107c5cca5a86796cea8b6f328d623c29405de86
-
SHA256
b0381a0d28f9df56cc921782013ff41650d197901e0ede79d7bb7513738e6854
-
SHA512
7ba3c8451a08969d41d5541fd330a75888cfd086fb355faf4bb8226b1bae9411cc72aa8fe537e2594ccd260e45e2b8d30bdafd0605b0b3af6b2fa350af28e99e
-
SSDEEP
3072:dvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:R1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0381a0d28f9df56cc921782013ff41650d197901e0ede79d7bb7513738e6854N.exe"C:\Users\Admin\AppData\Local\Temp\b0381a0d28f9df56cc921782013ff41650d197901e0ede79d7bb7513738e6854N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
1KB
MD5e4b22173d33cf33f34d3dc32a203b742
SHA1a76085d4fab1e145aab641d7fc9584da6532c88a
SHA25605a75b1dcd82f86a34ad6181ebfc55a361b949e10975ad3f854f1b663021a541
SHA51201952fa1707711654d4d58f2979f12dfeebf3bea11be4d617c2f8e2934e0f8f910c88900f29353c075ecb0d1962b5e69864bedb02582b27c714c7514929ed075
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5284ac317e96f451d79a9b99e107d4f96
SHA1f69759064840c7a23952ac3801f1b4760df672c1
SHA2561e65aee08c9ea6b096ddad2caa367d33a8a0340e749517594a0fcbe93d3b32d4
SHA5127e9311bce6537d0d2f3879f5e603d95b20fb0722e0a07b13e9ec3c305c218fe59ec75808f14b288e0e398e710cc8c3f357fc5b754a577cd75bdfee06924be684
-
Filesize
61KB
MD5fcb573298ed4045ee143b47e0f2fab89
SHA1473a3bbf60afb16b28fd483506c6cf22bd63a1e6
SHA256b206d2f458b04596b72a4ec273dd4610c37d648733c4a91526ba6f594e970d24
SHA51245eb83f560228001770ac2488464576c35b5d652bda3bde37b3177aff54e8df708bf81577eeddddf23f9416779dae5c3ced0216205fd728f471b3a4837c3b46a
-
Filesize
1KB
MD5504928b7f1493b0e722b86b3fe9d5e5c
SHA10b9966ced10a23ae5c9d874fece3ae6bb0ee8512
SHA2560b84bcb611239daba27514755a454861e475dd99180caa5060fac88f31ea3176
SHA512f961661d301f45ca3cc9e1e070fc4f8074c44ab2d934d7f1334cfd3afb805cb3fc87ebb229e809336630921dfbc31f3ea22815847392719d35ecb6b0a1e52378
-
Filesize
218KB
MD5cd70ffd0437727c656f9c0524c2a6c68
SHA1efe7e22555d941de661e92fe12844e987be6a901
SHA256d1680eeead07c992f288e50a06a39f5de4b1a20ce0bf6c6e1fb962bdeba3223d
SHA512322fe31b811d4f7ded25ccc9dec0eb285901a6465b1d69acde6436fc4932f22d60b738e5e3cb0624d18fb54e26001ffdc6a7101005e250e32a961bb008753d41
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB