Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-12-2024 22:34
General
-
Target
f81cd373c862dc6f828bbffc1ae242baab33ff4f0a66fe41aaa9d27091550fc4.exe
-
Size
218KB
-
MD5
2ed15b9f7f6a7bfadbfe69775cc3fb47
-
SHA1
395856298e52cc563ff529cbb5818f69d4abafa6
-
SHA256
f81cd373c862dc6f828bbffc1ae242baab33ff4f0a66fe41aaa9d27091550fc4
-
SHA512
5b70a4df3282394d0624444ca5a06c3e8613318f69f9a01292f1ac816195ddd7159d79759b5e6bbf96c85470669694ebfc706f91df855450ca4d9f664922063e
-
SSDEEP
3072:mvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Hu:Y1SyAJp6rjn1gOObn4b6h9L
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f81cd373c862dc6f828bbffc1ae242baab33ff4f0a66fe41aaa9d27091550fc4.exe"C:\Users\Admin\AppData\Local\Temp\f81cd373c862dc6f828bbffc1ae242baab33ff4f0a66fe41aaa9d27091550fc4.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5d3296e8d7c14fcca5ad44d435d566e65
SHA1457be466840d2950346196ad0ff6806dd0fdc4aa
SHA2562964c5f6e69d0a4b0ea53d106e0a57ac366bcf9b09659842d3b64297416bc9b1
SHA512f5f36a1fcd90ae1905ce1a011e4df0e269b0f841460dea5b8aa88a86a7be67b8876bab6273fdf648245e55255906a4cf636d704dab541a477a96809baca71150
-
Filesize
100KB
MD528d19bf0a544322633c3339233eb87b2
SHA110d81af392ce97eae7e3278fe595bb4369f4378d
SHA256cae31c766b03a24b82ac87c051db2b6404fff34b2b67fc6b197d2068286ee614
SHA51290f380313c83979ca770c02e787a3c51df922f771a38df5b4e34fbf68e1d82463257960a19ce86bf1386581054a9392db72f837b466601661546715987264d12
-
Filesize
100KB
MD5bc7fa6105864d2080d8290a763f6881b
SHA1a7f4ecddefc549b4d9c35d5097617f41b512fa01
SHA256dc5e0434cb285daed156318027aec87015c49185cd6a70db028603eaa192562a
SHA5120bfb43f9a5657090efc7bba866ed5e026a02e8b5fb2297e1f6d38b632f5906da1f407dd0800f3b62753c4c18d1223c688dce04c4bea032000d2c7858b83a7493
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
218KB
MD5bfa3692d69071b30a6cb1f8cc5541539
SHA1a71c7cad163fcb179879f26aba697d91a2abbdd2
SHA2566932d105f1d25cc20bcc29a3083b1c039c169e86cd3cd3ce6c052f0bab28c9e5
SHA51260b15a92a155186d595b11a206be9d77a6992ff08b6b0cf7c8497ae666fc888fa52cde1c7fc3ab2c34da7f057eaa0fa61507f6ed8b403b9d0c8939f6c2ce854f
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB