Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 00:59
General
-
Target
e067fc6104bfdea536241907b4da090b58beacabba16db31e70572160eba9e0c.exe
-
Size
218KB
-
MD5
26307e7bb2e97e205fa56b459c522c9e
-
SHA1
8abef2f4ff98c79a17612593ece28ae0ff8f5ab9
-
SHA256
e067fc6104bfdea536241907b4da090b58beacabba16db31e70572160eba9e0c
-
SHA512
3800412ccff2781d01f27a58c80b0b03751d1d3148901d5d1705338f103d2579fa32704493380a750bbdfb4bbdba7f093edff1384ee756370331f4c667af4be6
-
SSDEEP
3072:Mvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Ha:K1SyAJp6rjn1gOObn4b6h9x
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e067fc6104bfdea536241907b4da090b58beacabba16db31e70572160eba9e0c.exe"C:\Users\Admin\AppData\Local\Temp\e067fc6104bfdea536241907b4da090b58beacabba16db31e70572160eba9e0c.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5e6ba283b73ab5de22e84b36bb516539d
SHA1a1f4ee88ca1273a17cee2739a4d5f664b6e449cb
SHA25677453accf07f03d1e3a265c8e35a7461ebd563b0dc9622188c7ce43bddd6511d
SHA512b7207f1a2d788b63a6886be113456c3c3f687e7d7f9d5b45568d84de271fc647a539629ba99016dd4faeba527cb933ea213913dc1a9c96485a82024c66f7e03b
-
Filesize
61KB
MD5a60c6c8317e07c6e4d9930ba49d9763c
SHA1207d3effa21829b68e949a15c93c1a205dadf579
SHA256ce3980a25a3d0431ebdbe614c68e4b8c33162cb8aba66562335ee4ee9431c321
SHA51289534c46cb66386e0abed000716b238734ea3cdc831ab6faa181da02d3648b002fdb34ef37e300a3cb9cd1848459e6aa03f1d1e551235d2791b90e8f84be2053
-
Filesize
42KB
MD54388324c8ca0bfaacae56f5bae32d647
SHA1c8b3ddfa77dfe1b7cf15b18486797ef6114236b0
SHA256d640a7beb4724ce27a40d90d459aedad704df8f605247219ece6f5ec194b8f5a
SHA512c63d5b3224efeb6370b86071aad31c5c4632e1d5d6e4bc366a1be7c8877b839e6d19c6bbedd4a92a421b3526262d1054018c839b957dcd3f0ef79407a24909b9
-
Filesize
218KB
MD52791c26bbb1a49a20321d7afc6ac6bfc
SHA133ac6b826cec064051866fdc29f5eef2aac92a2f
SHA25691995071c2b84c1f5519d1917d7273577463330a5e3c7b388b8753ea9e4db4fe
SHA5122a41af032c71e3dd194700d09e9daeb0cac719ccbd516fb527b33b530dc31ba0da3ee38d26ed3cb8ba097d256ac26db0e5fecf460a4f8789f7e7a5dd385a2b7f
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB