Analysis
-
max time kernel
110s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 09:16
General
-
Target
fab2f8013ddc21ed4ff813ed9013fb32fe0ba1dadd63bc14b69fa4e0278e7621N.exe
-
Size
218KB
-
MD5
9fbaf593c98947100175f40cfd1554a0
-
SHA1
c0aba5a5e127e5a778d36a80a6b0626ab70b9f94
-
SHA256
fab2f8013ddc21ed4ff813ed9013fb32fe0ba1dadd63bc14b69fa4e0278e7621
-
SHA512
4fabf08cd31cea5914bbd69cc8fa4e2266363ff51a6baedf76c6d0333cfbc8cffcb53dc595e6ebb59ea0dcc2785ee7e2337150a59041261a264f3767f39a77ae
-
SSDEEP
3072:Xvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:f1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fab2f8013ddc21ed4ff813ed9013fb32fe0ba1dadd63bc14b69fa4e0278e7621N.exe"C:\Users\Admin\AppData\Local\Temp\fab2f8013ddc21ed4ff813ed9013fb32fe0ba1dadd63bc14b69fa4e0278e7621N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
1KB
MD5e0dc0dc3b7d1c06d1c22a5d1ce83bacc
SHA1b53ac49f49a48fa03162e4d0bb0ee4a5b637b1e9
SHA256676b0f44c47da8e7cdd2935c21fb25c14a1a8e58174b0e65fb2feff2beafd26e
SHA512de6675164a9ff6f5095b2341f1a1118d5d1b9aef7b4a2e02d012fdd69a8309f9722b0ebd17fe8d30c7a085d5c76cd0f4775efa17aed6577aa4025364d275ff12
-
Filesize
61KB
MD5b7f4103f15558771e86a4c427aabab97
SHA1925f064877fb31ff3c7ef61bb267fc03d94117a2
SHA256da1ee07c6e1f69cea558ada46e74b684359fed175445ba2079825d326d580e75
SHA512a9f292a46cafa6f2b7a006846ef76c6d9b8fec1fd32c51ad71ac31f7565741dc2ce715b0752edb8a14eb9fe7c095b3a12da3268714e85343ee306bccde629a14
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD573973ec13ce020a22b3222ea12ab8e87
SHA165444a92c41e1ea4dd07517dec4a41461727f696
SHA256707a7fc2b9bbdb900de08c26b42312d2c2319bc89549f82764145ae9617df372
SHA51297a015a45aaa2e836e27f7094c23de60c7288159006ffddb3405a0a49590ec19574f0cb7a2cd98933be450bb8976ae35f0d196dcb6663fb44482e710d2d00e4e
-
Filesize
218KB
MD55481392cf2b20bc01a87a506fa8ee2ef
SHA10a0aa36ebb36e4800107de25b712b3147dd462dc
SHA256d9464f2e045caf10e30ef752cfc7d21548afdd28577403b52d4b194e349eda8b
SHA51272b8ee6749ffa018b0521496c79dc456623fca301fecf350a9f984771f1a4c2312e59050a80dfc34e08f9c95f819a7cdd0643fea2aa91163b46ead7ea452188d
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB