Analysis
-
max time kernel
100s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 07:26
General
-
Target
60d052cb7e5723347829616e0d9434825e442a575199bc9db4bb53d069584787N.exe
-
Size
375KB
-
MD5
aa85721a7365b952ae799a07e05426d0
-
SHA1
0ea65ea0fd8cdebd19227b8365ced879a2d08364
-
SHA256
60d052cb7e5723347829616e0d9434825e442a575199bc9db4bb53d069584787
-
SHA512
110d08f1aae5d5e75bb4dde2306b7ec3c4cc8ec6e758851564f34a1cd1d6603a76d3bd2771195e67688deea04577c60b162d08bcea752555c86122783d941d3f
-
SSDEEP
6144:33EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:EmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\60d052cb7e5723347829616e0d9434825e442a575199bc9db4bb53d069584787N.exe"C:\Users\Admin\AppData\Local\Temp\60d052cb7e5723347829616e0d9434825e442a575199bc9db4bb53d069584787N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5a38cafc82412a3d53be785ad364422b8
SHA140d07de5785b9fdccfaf4765a2c2e34764cf75df
SHA256cfeded66e3d0011bfc0a158e382cd50525c504f9081590d1095208765c12dc75
SHA512ecd5833c8b4b0337805d12f30a0fca9014eccb1f0bce87f5635ea3f6bc81b616903697e995fc62a6813acef72c999b55b4d25faf5dc04b36118d340b8fd7dd71
-
Filesize
375KB
MD50095b6199bf8fb9202adc5706c972afc
SHA16a66feae3eadb7499df28572269cafb4b9350035
SHA256b041fdab9764fed2b36f29a290e27e19529d7611dc3c44b552fe8511c71264b4
SHA5129342a3e814a390b4fc059e19dc86bcb53936f8f7fac575dd962c7d1a2ae926812586de5e35df09aaaa2e985c0db7e52ea55bb601830b65ea3a8710138695bcc5
-
Filesize
400KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB