Analysis
-
max time kernel
111s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-12-2024 04:12
General
-
Target
32f60d4502a2dd7412d2e6d2c12ebc56f74206103df59e7fff2bd36a5562ce18N.exe
-
Size
204KB
-
MD5
8e8906ac736142a2aebb4ea257bc07d0
-
SHA1
133bb6c3620b1727220b5688d6ca73e62885d7bf
-
SHA256
32f60d4502a2dd7412d2e6d2c12ebc56f74206103df59e7fff2bd36a5562ce18
-
SHA512
0ee8d89c49d20873ebfb0151d51df4b773caf8547d390400355c5b267a773f08c43fd404e868b1e937bb5295aa72e97f160af7fd208251871f530e30205305cd
-
SSDEEP
3072:55u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:5LexkuRaX41xoyJV65gzyZko+uch
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\32f60d4502a2dd7412d2e6d2c12ebc56f74206103df59e7fff2bd36a5562ce18N.exe"C:\Users\Admin\AppData\Local\Temp\32f60d4502a2dd7412d2e6d2c12ebc56f74206103df59e7fff2bd36a5562ce18N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD59ec715675e36baf8dddfd2e2ac9e4c6d
SHA1eef03d72153b56dba828eede6dafdaab8167f238
SHA25633930c934e2fd847295e2cfb5a23f92135317356cc8c046f46d5d5bf007ada90
SHA51213eb42849e418c05e7b57a8e75e05182434a153d9f7cea7b1c6b7ffdea37e7324dc1f85f8445df251a38c2fdee3b1c8c85229d385c699ee98c0caefa5dcd48fe
-
Filesize
204KB
MD5f6e98d842a84f220ca4fc7f3744352b0
SHA165ece4d545edd5db83328f0b0873bacbdd977321
SHA256d2f386d05d2da4d4dfbcb37433660591786015607cc6d135561967cd602bf718
SHA5125048c4478d1a8c50cc9be90419cdb627c7db5b4fc77a1828d4b42b14386ab54ab06b4a16b74e527b7663a385e0a78e13e6a8446f8bee78f5921ae6710c55ed9a
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB