Analysis
-
max time kernel
111s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 22:17
General
-
Target
8f74e147495d3003534c3f97753e074639a9d9d82ae0dccf48eaea74fd91630cN.exe
-
Size
218KB
-
MD5
dbac50ae11f74f56baeaf940200c0810
-
SHA1
c302cdba3ab448121b9d1bd7746a843a70efad14
-
SHA256
8f74e147495d3003534c3f97753e074639a9d9d82ae0dccf48eaea74fd91630c
-
SHA512
2280aaed0c7b6d3998f853aa486eb8f4a5a44b29982ad318138aecfc840fc3c1486bcd029ae486d26f62f8b0ffd65bd3b6814c58f3f0bdeb71de64369d15f940
-
SSDEEP
3072:Avm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2HO:u1SyAJp6rjn1gOObn4b6h9b
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f74e147495d3003534c3f97753e074639a9d9d82ae0dccf48eaea74fd91630cN.exe"C:\Users\Admin\AppData\Local\Temp\8f74e147495d3003534c3f97753e074639a9d9d82ae0dccf48eaea74fd91630cN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5384f322f5927baeab22af05f68989711
SHA14e62a06c3625eaefb7e890833bd680bc4f97803b
SHA25615f25f910136b54e82ca9153908a7ad6e6dda8a12849f2d65100d20b4914c327
SHA5128bfc5c538359c5b2d87a3e209185339b86914ca91bfdd78feb59fdbfca1bd5936fb834061942f25c14ccda953fb8f8da9d899809d07fb0bac40c15cc753c3b43
-
Filesize
24KB
MD5ae71e95f0f3dbf3c0bfff7f9b1bf58d9
SHA146cc1491d2846823fda122a478d4caa7f99afad5
SHA25683ca9eb25062da7400201a4cbc7babf21d75539b78d7625f708102292ac2e732
SHA5125bf87ce1a4957aeefccdfb8c7366affbcab54163df03c71661f078b1fa99cdf553dad31338d19b4a707998e2814881a5de2392e9443f2d75918dca8e999da55a
-
Filesize
1KB
MD5a11cbe35d80245d3439b744e4c799d46
SHA106ebafcea2ec9a4cb73e8b6a44495f872bfa84ca
SHA25694bce0a68f7d799a19b53311bac6272361c48be0e60b89a3f591225c68949158
SHA512cff9952a5a429e04811e4250c06c960defe9c0e1ba2bf712d719c098b793ea4c815433135cb745234f580afaec38be6d21a5e2230ce04a4fc6aa9821e935c90f
-
Filesize
218KB
MD51b0980049e3696db110671ae7a79909d
SHA1666d08cadc48541d2e3ea429d148e5894d583780
SHA256378d9afba8b5e1b62435df9821d82b2011ca32df2238f4e45a7adf5bec9a0f7e
SHA51259770881ac75872a0eb42dc4185e745bc7456dec1894f504a281078b5b13dc813d935e2cc93786bbc0b390f12bd81bf2b8a2ab7f1e7557747a86eb840296e111
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB