Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/12/2024, 02:54
General
-
Target
245bc1edc2b19702b8b04bc28dacdc2eeb526f64c345f55a3fc84e37a1d4547f.exe
-
Size
686KB
-
MD5
7d2723f51e9c05dd8545798cff29ae11
-
SHA1
b2e9a10c8ffa61e3f032723a8d9d13c823cf9f54
-
SHA256
245bc1edc2b19702b8b04bc28dacdc2eeb526f64c345f55a3fc84e37a1d4547f
-
SHA512
d00c456d7f36eaa0e4a32f9bdcabe2fc8c8abf9f54ae5f59c410e12ffbd6fb75874ff21ce8a981cc7775c39b6d30222a9c2ba3ceea5cfcdc27005fda9bcf96fb
-
SSDEEP
12288:zmWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgpf:zmUNJyJqb1FcMap2ATT5itjCYZ3DSof
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\245bc1edc2b19702b8b04bc28dacdc2eeb526f64c345f55a3fc84e37a1d4547f.exe"C:\Users\Admin\AppData\Local\Temp\245bc1edc2b19702b8b04bc28dacdc2eeb526f64c345f55a3fc84e37a1d4547f.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD57152a10b54b8e0af81cd8ffe87c533a7
SHA1d9dcfc63e07d2355af1b494ea5fe61cbf09b43ed
SHA25662a3e75da549cbf3e4a57ac60b2e76444723c510b8f15256b8fb126977d6cb21
SHA5126419565af3275a8bb332f68d1de3ad6c0dad2f9c95f1a909799b5f5ea76d4cc785350acbd880e9e53026f774db21ececae3130d926ca668eb5794e7fa1a5556f
-
Filesize
24KB
MD5cd732aa3b196f955c935af7752dcc84e
SHA10a9d8d2fd12e869f4a789ccb37b682d9155a1170
SHA25660dd77791261254fd51e86dc32519e36c70406ac6a716603e03c41380f286f98
SHA51254dadf6b2c966202c8070c7c0d6c8877631e7a0c1c90cf171407c474080a0f6e36297e953e83b7c2a0a620bfda9026d4a50f06bccec318e83265e2086706636f
-
Filesize
686KB
MD5a2c7676f20efd7989034af192d1eb61d
SHA1bf26b50539842acb6cfa01bab6dcf7b36dca3b4c
SHA25641f03ed27b95895c190b66b19a51e92359b50d06e45f1ccf34963de879adf30e
SHA512cd494535e9c4c99a7ee82b090da36c5dfe4cbdffce0b8675162cfa3561413a97006e6a46e943e4ccde85802b8c0a59b4de642dbd17037b0ac3b2332c03cbe84f
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB