Analysis
-
max time kernel
113s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 04:30
General
-
Target
c545fe3170018c5b87e8b5c7dd22ad7d4fef76a4cf5c878520f56543067ccd4b.exe
-
Size
686KB
-
MD5
3c199ceae439f7e0ba573e00beb9c21a
-
SHA1
8154e33135e2c9f6b183c6ffa2971f19be8f9a14
-
SHA256
c545fe3170018c5b87e8b5c7dd22ad7d4fef76a4cf5c878520f56543067ccd4b
-
SHA512
cf98e120f8b7d1ae26932e8b363d0c8bc5dcb7f1ec01cfc014ffdd5f1622c55ae784e526aa2404083183d73ad8834b899c3bfc251401be7cb7daac3fa1261a20
-
SSDEEP
12288:imWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgpX:imUNJyJqb1FcMap2ATT5itjCYZ3DSoX
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c545fe3170018c5b87e8b5c7dd22ad7d4fef76a4cf5c878520f56543067ccd4b.exe"C:\Users\Admin\AppData\Local\Temp\c545fe3170018c5b87e8b5c7dd22ad7d4fef76a4cf5c878520f56543067ccd4b.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD50283eb9ea66e6a1a58189322be788e52
SHA11af680c6d0056f2803b4305758cc2e61c49a9424
SHA25635433a61814a59194497fd77bd144ff20fd981e241c065fe4809569e4e69a344
SHA512a5869282ea89b6569ee54c495c8406a3cec1ab0f235714178edb765abc7f3c3d62420a42f085db0e2756d5e574cc99f4f87508f4ea1175e7a2f24de38c8f8c70
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
61KB
MD575ab90538ef1480324ddf35f8e47f35d
SHA138ca76d44e73e823d14e15378067f17bae057039
SHA25673e68699cadb0327a56d65dab9993bf22525c900693cf0149656bd49e518ea1e
SHA5126a76b703e1bd2bff7ae3239f67b28dd87d848fdc7c0662de23597cd0e6a42cf75ad164d7d313d0655c2179604d004375560f7842a025461c76be62a9c8e2eec5
-
Filesize
1KB
MD555a45b2b3793077423566dbfbf9cb430
SHA1e3177b2c631aec00e99abb1ee5ec0c90456d1441
SHA25631f529a39c52252d57e967c1adfb444dfda16f3db59af7c8199ce0da3178638c
SHA5127b900777f4cca875e96afe39f217f725ac2b2fe641dee7a98a1e7f571b634ba807dadf57c22dab64226e48448793ab8688fe581535b175bff0aca96acf32c6c1
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD51fa2c9d47178af0c8c8065e0fbe0af51
SHA134ca8a033d7540f1d95a6b051753263d4cb42149
SHA256eecd632125d85af779339f5e50c4221e656d17f4ca68e66b0019f3f112f764d6
SHA51285e76d63054bc1e90231ebc9c77b6cc89c9199494c2fa09e6004c5243363759184cfcc7f28f4a1e1829d57dd145e9d35db1a14776f61a1f9fd43a9bb41f93c3d
-
Filesize
42KB
MD5b566feb2d042a13d32d786d70c5c3061
SHA1a4421f895c30cc4321330bc7c1b0a0521e48023f
SHA25635d4bbefc6cd04c1540ebdf13b650b45bdca06c8afca6aae85e45e612a27105c
SHA512386e7dcec8b95746dbb8276e3a3bf4321f7d1789f7e5421599032ee4ac44e0a14f50aa513c8ae0c127c1453c961e236a777114eb6bc2e1724ad1f8bc5cef4a39
-
Filesize
1KB
MD5bf761f76d7a7312d7f1759b79f1066ca
SHA122120a4f004254323917c551199b3fcf4f4aca92
SHA256b25ddc3ce70c500fdce394e678106449e506f0b0bf48bca3e2fb1d8e53d8ce1d
SHA5129413e31d95b56d7c848c804c34251682f55770e0239950077daa608589ecbcf225b3ce3ca7373881931bd883f407127ff3c17cac80a3960ee1b6226ad012d6c4
-
Filesize
686KB
MD557f27c87a5919a9cecbe86b1c89407e5
SHA159c7ba695ba967ae57a278830a021810e9819465
SHA256303ac860efe1ca28321a12b7e7c5e34adff4d4bdf6184509b92e4128aa623f7b
SHA51291f08c9295b9ca038d7b2e8500595053a4d4ce1a9fedd533f2b91318b50742ec46c42da337b1eab9c302db2251a71119056a755fc0a68aeafb86c61a01a9f34e
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB