Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 01:08
General
-
Target
8b3740defa75530f1caaedd89eb4e11be9052cd0b8a7af2fa8369a61ccb2d37f.exe
-
Size
218KB
-
MD5
8cbda4f1dbf688da1f76075594b62574
-
SHA1
93c35550755c08c1e51d233ccea649b7bd2a8783
-
SHA256
8b3740defa75530f1caaedd89eb4e11be9052cd0b8a7af2fa8369a61ccb2d37f
-
SHA512
9bf38560a6a9b4dcc5a2a00bb9a6f33763282e5f4abe30ea4184147011a6336435a4186205c3b4bdea3cbea71750c505ee1719771a9fd57800dc3c00f7b56872
-
SSDEEP
3072:Xvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Hu:f1SyAJp6rjn1gOObn4b6h9L
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b3740defa75530f1caaedd89eb4e11be9052cd0b8a7af2fa8369a61ccb2d37f.exe"C:\Users\Admin\AppData\Local\Temp\8b3740defa75530f1caaedd89eb4e11be9052cd0b8a7af2fa8369a61ccb2d37f.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5039a4a5774041c05728f71be4c653c23
SHA14a81c2f51baa072a67cb632715b31399cb051ba9
SHA256d24b38ab95bbb64e4fc96f3fcff7c63ca50ad514dde5902d97cf1cdc46ddd60b
SHA5129438f038401d58eb120002824220221ef31ea27942d61d11be47df72a201ebc6a07d6d23ccc999e9e86e19c843d3ac3f813521a5ea4f8ebf7a078d4289d58cd7
-
Filesize
218KB
MD5cb0044133112e10d814ac189188051a3
SHA1429dd76f44a39448b9da56366a7d1e3b97815678
SHA2569d0372e1b77db22aad11add6f257bf023a1be6777baeab53985dc8d34884be01
SHA5120988d41b525df7c97d7d3248f796682f5af922ab28b29d762f0aaaed08fee32c7e5527a8aa4e7d8e5968176027671a0a1aecf82090b2bbdfe4fc0e4c8f8b52a2
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB