Analysis
-
max time kernel
111s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 23:38
General
-
Target
ab5861e2101bfcb72a6ef89a60a5b1f67da3fa49de61fd8c1038c0bda3eb92b8N.exe
-
Size
208KB
-
MD5
6720155306c26b338515957d1171ac20
-
SHA1
e37fbc46c416d62443c162773628a1be8d554440
-
SHA256
ab5861e2101bfcb72a6ef89a60a5b1f67da3fa49de61fd8c1038c0bda3eb92b8
-
SHA512
95c127ccc737dd6b7fb76b8e52007d60637cf0e2ed7cacb15ce772d47517bca793dc35621a81a1f62481447abf3f3a7fa2480391277971b9c4ab2a09fc8a1aed
-
SSDEEP
6144:Ga1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkw:GbapK0JCmRcU9vVokfj
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab5861e2101bfcb72a6ef89a60a5b1f67da3fa49de61fd8c1038c0bda3eb92b8N.exe"C:\Users\Admin\AppData\Local\Temp\ab5861e2101bfcb72a6ef89a60a5b1f67da3fa49de61fd8c1038c0bda3eb92b8N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d507a0b410a189b52abe3b18550bcee1
SHA1555bf44bda1c17807031549076231f296ad6aed1
SHA2563db2c4fb75312292f848f777c4e37c06c0b804339f5f138c2324c4dec7b9286a
SHA512295e8771d21c1d0e82b2c30f2218df210af95c0b24592fa8af0450786bb783e7cb08860a2b1af54fe10c027b29646429fb556ef3b9452b0b9faac9705bd8d653
-
Filesize
24KB
MD5b4dbd08a7c682b5dd5189a101a8ef582
SHA1ebf1587dde486093f77cc0799c2fff25161d5078
SHA2562349983b64bb13f6eac96600b4fb185795a55e7466b9585b864182826d9d434e
SHA5126192d9ede9a058f98cb66b7d4c9ea09fba58c658972fab7c727f4786c6d75080ed4683065eb893c7e069afbc18ff486e0e2d016e4408a545e8bb01b474659504
-
Filesize
208KB
MD587a011108773f5ccc0ee833ff6ae9148
SHA1029ba014d1cfb40090b7ecd6da01b2cd1c28ae65
SHA25625601232d2cbd59ee99ade1f7be7a54877b56b184ca8e0b7c327cde309ee8e1f
SHA512d272b57c9cf9cae701602160ec103cbb38f707799581edb46e1a4376da21c03369037c950aeb31639e7cbfdb8df76594fd37dbaa09c1cabed1b5e6eab79013ad
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB