Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-12-2024 04:06
General
-
Target
c7e6e55e382c4011b56fa52db3dc076215e3d880bf7c52fa5a6f26a21f069e6fN.exe
-
Size
355KB
-
MD5
e08f5e14795b342c881a797f79eb5030
-
SHA1
c16f989b87698352671cae8a8521b583c257d340
-
SHA256
c7e6e55e382c4011b56fa52db3dc076215e3d880bf7c52fa5a6f26a21f069e6f
-
SHA512
56b5ed968e86489ea25b392b2b114bd7f05eaa9fd9ecaaa5b1760cda5e86cc1e44e6531c58b471540ea8a23e82d274ec9b7c73f632471f403f2426d4fd7c55a9
-
SSDEEP
6144:83EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:3mWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7e6e55e382c4011b56fa52db3dc076215e3d880bf7c52fa5a6f26a21f069e6fN.exe"C:\Users\Admin\AppData\Local\Temp\c7e6e55e382c4011b56fa52db3dc076215e3d880bf7c52fa5a6f26a21f069e6fN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5a15a8a13c64dcdf5250c4a65fa3193ed
SHA14342b13a0cc4693105dfb7a0facd4eb4dafb6876
SHA25641ba95eda774c22120a63e07cf96dc74b4772d040de3211b0b978cd51f5f4891
SHA512cb0c67198f73a9a1c8c772c17f5143b66cca2813f98a9373c91edaf77f2b894f67f4f6d805e2c531f36f6c82887773709501a394e4448107ef6717058937e1d5
-
Filesize
24KB
MD5c890303b4287ddcc9006f75bd654026b
SHA1127c56dba6dd09535a4ea236d951b4ae321c5ec4
SHA256c2beef7e97b39acb014bba2c6bbeb209e12686b61cab76d53ff78393231227b3
SHA512e3e0c0ec88036aedf939c327f2e3c32088ece77c3af4ba16bfe7606f63d4d2c3f1cbb632b0be82ba4ad3208b5abd2436853ff65d6efa023f27111ed5da8aeea5
-
Filesize
355KB
MD529bb5c511d3022d177e3172cd0139996
SHA13407cb62923bc79f2ddc60fbfdbdae1e4c7faf55
SHA2568652ac4850fc0b07825073ecfeefea994b9173dce18a94612a79a6bbd5a7396d
SHA512cf836d4a85ddbbbd4dcd2c1446b3338efec39da72c9b7d5e54da22fe53f3cb9abff4a498dc2f1fc837b1178ac3294c25cf8da5113638079d278cc22a07c86323
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB