Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 23:47
General
-
Target
4f86d11e486080ce57a62c9b4133034af04f579980329d80d127dbafc984ef19.exe
-
Size
218KB
-
MD5
86db8d1ccedac698bde5cd9d41872b56
-
SHA1
1cc46f878ff5dfbb49dde171362d3fc1532a5ebe
-
SHA256
4f86d11e486080ce57a62c9b4133034af04f579980329d80d127dbafc984ef19
-
SHA512
d8b4f94c1e291fd9293f1295754db9b5cf77de24170402534a550391b07b8812cd8da351c479dde055ad75137451c685cecf7f694105ed284a7c40330828a82b
-
SSDEEP
3072:6vm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:M1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f86d11e486080ce57a62c9b4133034af04f579980329d80d127dbafc984ef19.exe"C:\Users\Admin\AppData\Local\Temp\4f86d11e486080ce57a62c9b4133034af04f579980329d80d127dbafc984ef19.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD50596a65a9cc51dfd8928d596d9ba46c0
SHA14ccc710bd6125c757e319db9b197928326cd1fe3
SHA256ea32fefb48a06d811d38d5b34d2a877286973fc43c0bdc3137b0bd19c73087a9
SHA51207c076c93fde1eae8c464a1c7c086abe6ce233aae952cd5a54a44676beaa7afe1438496b4f749a12d3b0fd33d74f21e9f7b2ad3308341aad449768cfa34f85cc
-
Filesize
1KB
MD576be2199e877e47c5fc91b3d370a42a1
SHA1d23c7d251228549b902949b55f3e39b2d8eaf4c7
SHA256ad890e86d47356a9c2240636e162c5000454793f9ea230694086f17533678d6a
SHA512f2ead41501cc8c64f886e58af7f1a3e8645b1aa213d5ed1e0c1f0b39ca62ded14bbf815de54092219e812e6316052944c0516b8306224ebf28707bc742dfa881
-
Filesize
218KB
MD56c20ac1915cdb49465803b9fb35608d3
SHA12cde78833d0d3a6eb49e5ee0667fd1b83a71c6e4
SHA256301408d65972b374d2966fb959e316842ddd91556bcb43385c4f8c2c653ad28f
SHA51275eb254a976032243c9116c11e596770b5655b2fa4282042e4524f7f90a748700213fb35dd7e3535cbd4bac8920f6be4f90347abb30355774f0699e5b4bc58fb
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB