Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 08:53
General
-
Target
8dc47bcab58b6b00866428b48962a9ce9c4aea0f95704a63249c9cc6307fe0c2.exe
-
Size
375KB
-
MD5
72961f3f7a8686c7d6c76e4e8273c2e7
-
SHA1
e901ca470cbff013a18bceb4253e5d01c6b0d1df
-
SHA256
8dc47bcab58b6b00866428b48962a9ce9c4aea0f95704a63249c9cc6307fe0c2
-
SHA512
bbd00a1b038c060140de1fd4250e655cbd5d3b6e2fdd6228784bdce6eab3098911e9c99547943fc9a500bd80fa615e3d1d61230047e280fc848f25d3c936e8bb
-
SSDEEP
6144:R3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eis:WmWhND9yJz+b1FcMLmp2ATTSsds
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dc47bcab58b6b00866428b48962a9ce9c4aea0f95704a63249c9cc6307fe0c2.exe"C:\Users\Admin\AppData\Local\Temp\8dc47bcab58b6b00866428b48962a9ce9c4aea0f95704a63249c9cc6307fe0c2.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD52b5f1894b6ac250f84ce10428d4dedfa
SHA1a148dc0d1e4b5f4260cbf66b055ec0fb68daed82
SHA256ba75ef19c13b5b070d21a380229b06320ef99012c9b64e45bc10c00d803b1398
SHA512bfec677e2601b24e98d9c437e3290cb9f5936ffa7cbc2184113eb5c89c8ec3d5cd849c6f5f3c0b7838432a4af73b761fd73b64973f53dd2658f770547661713e
-
Filesize
1KB
MD5efc816277a8112676c48283d36957689
SHA1aaf7306c1f09afce6b2840d55c16ab2c5e3437d9
SHA256a9690bc8a73a9afefe9bcf6717056f44829ae6770fa0b935f784089073903616
SHA5123853910ffffa24d7b72c2302d56ef355ca821b8edde53362af04453d4010c729cafc81b208477b3b6972d5e28d25f20087245d5df7bc8d514b1dd360dba67932
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD582322ddcbafbbec75d86f376e7889700
SHA1238efc90b4be08e24134130d9876d61b550d3cfe
SHA2568b275c7c8346a7395fd3cd95a0c973856c0acf1779b283bb112eb0f0021cc5db
SHA512ad761f435c10688eecf93669bd7bc09dd0acbea00bc75b6b687ad568cb8d7a6d56c02567915d6df8cfcd43d96728fc901d35ae289ea3754a1f2062245fea4ac2
-
Filesize
61KB
MD5b1a0c3ae0f583f28c3a654dd7c9a7c25
SHA1de79a038c2003249c66cc3b4a066f2ae4abd72b4
SHA2565271985dadb6a7cd5c66c76e98280ad954864ae73657812e41836efeed3301c1
SHA51263b720454eb1138cdde24674ffc5f948fe2ae8cd09e230735a97f0757b75c3a5dd52346f2876d7a506f3d5d474eb5b5260a59fbfc17f85af76b4ef6086df9ace
-
Filesize
42KB
MD56efcd74eb3ce0a35bf355443c25ef2a3
SHA12f797420f66147149e9f74ed233716b5f101709a
SHA256fd6df376b10a913c41e4a6b726f28bca633a20b1bbbe80e0bcc7ac6fc9ed484e
SHA512c237482347b4d8f291db7d69797bb36a29dfb9c289dec696395cebde5207a0d1259a0cad23e2a5ca1c47797331e6f0a67b0d0ba4cf58fd9e242f60881afadd82
-
Filesize
42KB
MD5385eab3b3942a7d789ff6b6f448941b3
SHA1a4f84fb3b61c2a270aee2d0a07a2c62621be2862
SHA256ac8730c9771f23d580c32005b99f8784c80aa52005c37ea51a148687fffcebd7
SHA512afe893cc00b7a3451f2d882e19cb071a69d48f66d82ce93723cae8355d4da7e641567d0c15360c8393e1d39a847a90be88c03953e2fc64fa7d2550acaa328311
-
Filesize
375KB
MD571c14482ead79fb415f89940ee5fc9d4
SHA1b669111275f7dd250425f23b15d987e2de7ff38f
SHA2569a2bda0444d8d77a42168e669084ea4cffa48cd78e12f81303992ff25f13b328
SHA5125507ba34afcfaa2f69f565e6ade79aac1fbd557517571d9b8c9f1d0e319d485d8aa77af6e55655ecd5b7926bcce99146a8ce632e48ff4b1db0792a4406382b31
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB