Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 11:27
General
-
Target
19ba9bbd06014f0319826468c397d520bc88cb2d21f5966a60179ee2fa9297b3.exe
-
Size
212KB
-
MD5
7861f6588717f047b11e3afbdc7ab80e
-
SHA1
d4a6dcbbbdb52b9688deeb9b2fea69a6dedde2d8
-
SHA256
19ba9bbd06014f0319826468c397d520bc88cb2d21f5966a60179ee2fa9297b3
-
SHA512
06f9727536332e2b308b4eabed04bc161a203093bbdba1f49a180739c91233c4427ff424e69e681bf49f58150d4bc92c3c73db6ce561b22b696740b9d4a91c79
-
SSDEEP
3072:SGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb8:SG/iVkO20SFgBhxtW9mG9+Umt3Ezjb8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\19ba9bbd06014f0319826468c397d520bc88cb2d21f5966a60179ee2fa9297b3.exe"C:\Users\Admin\AppData\Local\Temp\19ba9bbd06014f0319826468c397d520bc88cb2d21f5966a60179ee2fa9297b3.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD55ea1c32cdd1cc51104c31502fe1815a5
SHA1a9752253903115c7be9a63cfb66aad33a014bb82
SHA256d6cfbd81dc3592b9fba6c4d3b722354b2c8d59e03232ac95f44fb046613605ff
SHA51266b9d809163245444c369848db0570b19c5fccafe3d4a7e59f5c0946d9cdd772d5d941ca99c463ac2cf565968220c26f5fc225daffa23ce8acddc5b1bdc0c8cc
-
Filesize
42KB
MD59885ade6944aa3a1a0c14dd915a7adc8
SHA1df6fa082bc5edc982013dd8801d4efb4b2ff6cd3
SHA256627d9add2f7f1014f5e8ae2a9776f27ca8fefa2bec687c206207b578533eb97e
SHA512118683c4252b44516a5f42ba34ad96dac36eeb98bbde18a51dab7a2230d7d31984cc9f6d06adfce769e8f072171cd8ead4fce1a06378b50100da86d3ad44f6c3
-
Filesize
61KB
MD508b37dc7fec668d31ff62f7c5faf1590
SHA162945ad89d8cd0d1db35fbb412ef57770376892b
SHA256e78898681f0c8240b52aef58f1a9909558792f023c75d7c0f9fe0dc878a95a45
SHA512ce925a4fe0849f75482b1103cd717779ca4cb2a9280f7bc2d9a59f2fa02b2e673afe685274b1b39408b00dbce18ebc6a507a20175a127c146a431d98fcc93ac1
-
Filesize
24KB
MD575ddd89b2cd162732dfc1ace1861fa43
SHA133bf854db185289c6a05ad60f2992f8be1dbc6fb
SHA256816e29195f44455b1f08066c4dedec8f9634f970b56112b30c59617b86943560
SHA512d28e1edfc90cf4c441eb19329a7f48e3de8d80d2e5eca19e71e81a3d9d4f5aa92085af1336c80d4c852ce68d6575bf77c3e9b2ee52996a0ec5fbc1d7907fb8f2
-
Filesize
1KB
MD5c42c00d613087217345f64f3760e1d34
SHA1f1a27b78298501385d0dd6e6a52e8d6382aaa0b5
SHA25651b540af3a170b187e1784dfb4fecb26e3665ae81ab7b2c36de80415f500f5fa
SHA512ba6cc3d774548345e68845c737ad61494ba51b854298ac6e699aa7ea25628ca7e12182af95cb3b3735dda2949452839f201d8afee5697e01c84e548f28df9a71
-
Filesize
212KB
MD54553d908e4a14b79e637c52a3b579d8b
SHA1faaee256727220976c5a3d3fefb3e28fee56a714
SHA2564a32e5f7c8c114c60e13d8c7cfb57d3a72961f4ec12ebc3866a2d4c5cd273204
SHA51250396dd26f011025c569c4110c6d11057393af66f19096e269ec3c0b71b097af2786f0356575f62770d032e2457798541c867e2a747be5e07d13a6e8feb56609
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB