Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 08:27
General
-
Target
a99ccce46872f988d2b9fe5fefd3501a297bbe612e45f27ba114364e26177d28.exe
-
Size
218KB
-
MD5
6c89f7fbfacd88c622d604d64901356d
-
SHA1
ccbe262a7ebf42d7a23f1a446804b156a9ad3caa
-
SHA256
a99ccce46872f988d2b9fe5fefd3501a297bbe612e45f27ba114364e26177d28
-
SHA512
28775515352fedad535db982efa23413677518da7b07e0e8cb6b6f55fa36406e626364bdff8bf897e2b2b00b69953f9be5686b7de18ea2d95e1fe77bb254c6bb
-
SSDEEP
3072:Fvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Hq:J1SyAJp6rjn1gOObn4b6h9J
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a99ccce46872f988d2b9fe5fefd3501a297bbe612e45f27ba114364e26177d28.exe"C:\Users\Admin\AppData\Local\Temp\a99ccce46872f988d2b9fe5fefd3501a297bbe612e45f27ba114364e26177d28.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD51a70418c984e3891ac50c5dba2f5d556
SHA167926e84a8415067456a1c0311622994135e6aa6
SHA2560c591b80276e22d62af0a6da0c6e7a5fb7a8c7a3a367ef21796a6cb05e64b0ef
SHA51261f01dd17a59170a9758ba2ffdf93326ae0e04586063f76445dea4965cc18998b7f3bcc50c7669a7907cdbad191dd54d7dae793d839052e2b45ec21809f430ff
-
Filesize
42KB
MD535425b531750b216a3c8f3132f20e1f0
SHA15d65bc54cda84224da65f995d24a96513f533a57
SHA2569989c03d70e3d5a046bcdcd5aab1ecd9466931f67b7b1f2411dd30c7075c5086
SHA51287a4aba06bc8aee68a54a3df48e48638286e211ee3bfbcbc0438690f572a9fdc1c9c116cd40f84d156ce1344558cc137d08834ff2a55348dfa96e6f073c32d81
-
Filesize
42KB
MD506c160e4d3f17d46bb651445e971c392
SHA1d7f99d488da0e08d3eadbededf90330fc0c3852a
SHA2569a0d94ec54a9b0700453aab4ecc24a2c0584fb4543fb20f7d3f9fbd06e815396
SHA5124d6d3534b94d29eec2f399ca9427f37d7a1c3601490497ce33b074b859717ef78f984f952efef1e95c01764b3ef512e576f0a0829d6145079203d33e9b703127
-
Filesize
1KB
MD5246262cd34bd71a13a5bf7218bd7bc46
SHA17b98d60621e758874e75ff1024f4b4d0637c58f5
SHA2560d80f60d95292818c5608cee724e3ab64d06f4380c466dc2b588c18d5b0474e8
SHA51222fa136daf5c18778f3e44610457239c7d2e69f8de65d1243976cf283eed6412a0dd6a119eff3d65aa929adabfa33249a8e017f6c891762fc11e0241181ae230
-
Filesize
218KB
MD57b051196a0b01231163e0b38a6fde338
SHA17422b02097fe6ede78b98b6dab36e54b00801a3a
SHA256eda56e5e63db8e8093772297d6f377cc1ac23b25f3c63cbe7f5ec755304ec64b
SHA512fd907cb61c2695526666f0776de66a942aac1892f00a1650da7136d1cbd9e7336a4bcc3426dba2c75f92281a5a57ef9265a95f2aae82288aecacfdb12213ac22
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB