Analysis
-
max time kernel
111s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-12-2024 03:00
General
-
Target
1e499d80be9078b4f831e59ba6ffa4856ea2bbdd9d3bab9fff6f1ac8803a039aN.exe
-
Size
217KB
-
MD5
0a315e017dc1f7149aa1a4642d7cff30
-
SHA1
5cd4346a417c08d47bc5209161c0772047138ac5
-
SHA256
1e499d80be9078b4f831e59ba6ffa4856ea2bbdd9d3bab9fff6f1ac8803a039a
-
SHA512
f79762b0aef7e0e4222eb6bcc7b53e9704419cb92dc8be94b9ed1ac67791bf07e6ea46798cd59bc26a10fecad6392c31fd46779da31e6f31b6bae85fb32ea394
-
SSDEEP
6144:IrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:asTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e499d80be9078b4f831e59ba6ffa4856ea2bbdd9d3bab9fff6f1ac8803a039aN.exe"C:\Users\Admin\AppData\Local\Temp\1e499d80be9078b4f831e59ba6ffa4856ea2bbdd9d3bab9fff6f1ac8803a039aN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5aac9702e54095f30a9186b0a53f5efa1
SHA1120552a5d71d94228339a9fb719f2f4d8de7492e
SHA256895b81b73c70965bbc087cdbcd4402cc69509f0aa6b0f73e84b5c10d91dfd79b
SHA5121d2397844792b57a638786f15c10606cafed387133e9519ca5481ee685c42741425f87ae13c48445172bba74ef034505a425cc6a17249483b443ff1d8ad42152
-
Filesize
217KB
MD5ac5ff82212e2781dadc1e5df042f9157
SHA19893131eb11faeda6af47e15dee1617b226f72d9
SHA25658ea5872d5a049612215e5fc4bd802a05a4c12b1ce8abaf0dbe93a42c613e0bb
SHA5123c1e062fa56f0a7c186c826903fd8746af49638ccbc252b6387fe40b45d8ff145b0092a1dcc8dc1a255db35525fa9dccace97a5a015307ce87b0977a262c4de0
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
1.5MB