Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 11:17
General
-
Target
d9d63361a5331a2cbe1cf340bb0a9978f217ccabc27dd18c147fe019c75dc2bfN.exe
-
Size
686KB
-
MD5
94ce44d2ec61a1d445c4b5e286ccb420
-
SHA1
cdf802152918990f0c9abc58fb5d41cbaa0c7cd9
-
SHA256
d9d63361a5331a2cbe1cf340bb0a9978f217ccabc27dd18c147fe019c75dc2bf
-
SHA512
6c7669e75666682108c947c660b05cfab46390dd15b53e4dfca2ed604c25e01190f6fefbaa13f3fcf1f3672b540f227503b0878db5976d9146b8d508c910a888
-
SSDEEP
12288:imWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgp:imUNJyJqb1FcMap2ATT5itjCYZ3DSo
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9d63361a5331a2cbe1cf340bb0a9978f217ccabc27dd18c147fe019c75dc2bfN.exe"C:\Users\Admin\AppData\Local\Temp\d9d63361a5331a2cbe1cf340bb0a9978f217ccabc27dd18c147fe019c75dc2bfN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
24KB
MD500a6d092a814ac88cda92bd139f139e9
SHA12ffdc80b79a8d7b4a6333b2638f7600647d8b37b
SHA2560f04bf8471895d381b181b890695e7474693f000b9b2966683fe689e15113864
SHA51249f684ff0c263f9df02ecd1d8e3f3bb6c84151f0c8390adee54fcd3e6bd36388b60440e842ed83908dfa17807734c2465c4a2b45e26784bde235a326b153f868
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5e6d47d5e3c8908de5b1904754ac53eff
SHA1fc1b3267dd79f0d52ee06d35ae532269175be6bc
SHA256ba39b07281b24554a7e0eaff7b9937857ff9381d5e9019e31ec63f552edbfdc5
SHA512c44d67ef5091fa7a952a15c9de9fe49d3fc5534f2dc2ea00e885be06cc5574b28cd7295d78b0f5cffa7daacc06947e405c886ecde77b8eb5f15370601193e975
-
Filesize
1KB
MD5fd5c0c0b1e53bdbfcdeb98e6f0aaa56f
SHA1f686b5b46f10e0e9b8888124788c0f01b1f3f7a3
SHA256e580ce3a717630252f58a64ec3a39b9f631b0d79c1e6d6d7bfabfeef3ad57beb
SHA512f7036d8822a4a1b123cb62a85e3dc6a801142bc54d2b9b849e61ff775c222d4cc0df784e5fd7469995d61cd89dcfe9f8b0e0208888641b6212f857b283019a20
-
Filesize
24KB
MD56a039ad0d63f1af333ea8b10ddc2eeaa
SHA1756fda8b3381f5ead99a198728f30adda08027f8
SHA2566d680863c9c65077971f09168be7411520abc3d9ea151ba99954c24055328365
SHA512db0c4788611a371aeeb23da0d30e6ddf6f7c1049c019884ddb0f84086ef36c579857307b2e2f90b3f246445331d20c0a6e31b40d87aac33a8a2500b43beb37fb
-
Filesize
42KB
MD5346d31102a179eb395b13ab3d8296003
SHA1fbdf70e415caec5143027cc386dc5108bc9aea7a
SHA2565991fdfd5f7931bb8ca486d1bb7f745cd9c9695ea37c96c9cb6458a128569f52
SHA512e049079eb15ce4ec3b22ca637fc5520c5c1fa8deba51fea3ea1cb6e36e827811be9d444d3d9193438b0d9100bb6b0cbe540e6faa5188ac2d42ab4dda7b2a9ab5
-
Filesize
686KB
MD535acfc161a410f3893685b933d3c69fb
SHA12de2e17d85788c442ea30c199e1e6d5f34e78b2e
SHA256c2bdb8508c186224dc83ecabb673258175a17fe86ef09dfef5c0df81f2e6172c
SHA512b0a1ac9fab4aaac29b8731e0a5a0242b557e693bde4e2b396d7e43a757a8b436179772caedf3e3b7a49cf7fba19e764488d52ead054f8a162ff79a120d794ca7
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB