Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 06:49
General
-
Target
7e402ad96be779b1badd553634d4027d4a8cbe90cb4920fc6c1a1dff3bb4e9abN.exe
-
Size
218KB
-
MD5
79c0173a02fba9fbc6f0df8b979f9e90
-
SHA1
ed42cc11d715acdb855f320b44bacf225f1bfc02
-
SHA256
7e402ad96be779b1badd553634d4027d4a8cbe90cb4920fc6c1a1dff3bb4e9ab
-
SHA512
57eba2493f71680bd35d69235f77d5f72485873e3e47b106a17443fcf7a60700eb79203b1af5ecf8c18bcac396e0e89e09d3d12b3739167f1fba9628edc80528
-
SSDEEP
6144:LEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:LEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e402ad96be779b1badd553634d4027d4a8cbe90cb4920fc6c1a1dff3bb4e9abN.exe"C:\Users\Admin\AppData\Local\Temp\7e402ad96be779b1badd553634d4027d4a8cbe90cb4920fc6c1a1dff3bb4e9abN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD5b2ffc2c0a4499c0713d8ae9c63f0e52a
SHA1dab6b67ed9ef9e6dddd8a21451978e24f16922e9
SHA2560336add2a514f85aa159d6c39408700047f63aa168d70e78653119b5fce4c7b9
SHA512be02faf53fbf4398481c9bd351098d89271400789b8a8518ca0933d8609a7a94ad3cf09265e2ac97b9b38c7918e766af16c974e0e4632e43f4cbfe2e3ff25ad2
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB