Analysis
-
max time kernel
116s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 00:33
General
-
Target
24969993f8835ba7da7ad68853f2ccbdcc22a9fd801df50b20c921ba297b7f90N.exe
-
Size
212KB
-
MD5
add558a89362338ff76799d266864620
-
SHA1
1e6599db81b57e4ae4e099689989af3cfc72888d
-
SHA256
24969993f8835ba7da7ad68853f2ccbdcc22a9fd801df50b20c921ba297b7f90
-
SHA512
3f2f7dd8a1f9405549f86a5a3cc31ac055da751a12e917c523b3d7c09fbfe8628d250a1ee67d72112e9f8fa3912c7d4ced1c36648e330e9da0ec66e68c31e504
-
SSDEEP
3072:SGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:SG/iVkO20SFgBhxtW9mG9+Umt3Ezjb
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24969993f8835ba7da7ad68853f2ccbdcc22a9fd801df50b20c921ba297b7f90N.exe"C:\Users\Admin\AppData\Local\Temp\24969993f8835ba7da7ad68853f2ccbdcc22a9fd801df50b20c921ba297b7f90N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5f6c65a93678b58a2a9034cfb3d21b7a5
SHA1c44e8187fe5e1b0e81ce2f00125256d74b7bd044
SHA2568ebf3426a50d5ccb7cedf365db72233d4a75ca3aaa9fc7942204c835601e6068
SHA51220e016fcf660d5a9c5a15ba73c1b612e190579c1ffc2c3a151cf97574e8c6c7dcb41f37fd293598266c88ace5c3b807a67c30930f28ea5a475946e88a45ff4b7
-
Filesize
1KB
MD52a716981b579f31930a0389a7ed9dbd8
SHA11a5972753e9d4c6e6d177faff9006eb2437802bc
SHA256b9929891d16e86e26dd1a5cf5da5843e065deb34d150302932a236c2442d5754
SHA512080ab51e478d9621b57352b310e18f39e571e820443a1d2f80932debd5b41c54956ceda3bd156dfb95a8d888dab91cb4441e88a6cca2fbd5b77b32fa1907ea10
-
Filesize
42KB
MD59418ed2d6e41626c994cca8a2fdb0535
SHA116f11ff5cafc2e97a3bce1fdd2355d70b2b105f0
SHA2560a1b2766ac697de3d8235a49aa326b3da7f152f8cf5778ade83cac2575de2036
SHA51265d44f99c26cc1f4e15e54bdf82cf35dba941002297a0093ef7f798b6a1a92d3735809bae93b448e8c87244eac97c97b0742e9727714aae4a5c28e0194cf2052
-
Filesize
42KB
MD568bd45e8d17fe18f6c7c70aab52e1aa4
SHA18ee7ed37db4812903e5a972138026d916c815e92
SHA256461cb55493651f27dcbc6a0caf527f8975ea8bfa3a9a2de1d69a61701fd0bb76
SHA512f3e6980e43e5d030f61df04c9d9940dae19eb3fbce6c29de13f7278a974cce51d4478b325f86a582b03876925875401c5b4906e78be57fb48a397b1e8e8fc7e0
-
Filesize
212KB
MD50331a65c3761892c8f014cef135b0388
SHA14ed12076189f50f89c0b5302d72735a4f63db606
SHA25633d39c77b1cc64948b10e945211695ef43c8bc9f2c7fbc42919e2c48d9c61c3a
SHA512b16173fb97591343c679072dc25463e097bf27f74a3682c0a7e95ab3e73aa24386e287a7685cb98c1683eeb1b0e9041ccdbbeace5519c890a43505d98390df91
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB