Analysis
-
max time kernel
110s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 09:58
General
-
Target
68e8762b3780fae78d851410f1c651b438568dc632550bbff2a713c8505baac6.exe
-
Size
204KB
-
MD5
d448c0a042a1a6bbf81a2f694ef00fd6
-
SHA1
d76c43b5d92a16b47d13dbd2d90f8a2109df3451
-
SHA256
68e8762b3780fae78d851410f1c651b438568dc632550bbff2a713c8505baac6
-
SHA512
17955f85af7301d3b23f3be7808b5fe26e494168473155bb12bb341db30eebf61b3d065300900480742c1e494a39e149a10c92247f00d617c475dd99cff0a21b
-
SSDEEP
3072:65u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAQ:6LexkuRaX41xoyJV65gzyZko+ucj
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68e8762b3780fae78d851410f1c651b438568dc632550bbff2a713c8505baac6.exe"C:\Users\Admin\AppData\Local\Temp\68e8762b3780fae78d851410f1c651b438568dc632550bbff2a713c8505baac6.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD555408335f2a2178af34be50c58487ba8
SHA17922fe9e0c275a085931955e9ebb7d3d027c1e22
SHA256d0f66c09ebfbdbfd66ec535e044ea11a6d52d78f119c793ffbac5d828d6833d4
SHA5126ee9e9476a417237899aa7597a1b771d67cd639873b3145f30573a8a4d6a19a9637d3291f8b5e8f36be142957108b4ca96d07fb45e4f95c2057f30106bbf0985
-
Filesize
204KB
MD590ee418f15198f2afd944184310127cb
SHA106757b5b12e15e306e06555d44174d0439bbe231
SHA2566d6bfbed6e66d89ce8aab7dbad59c9c7a4fc1229a7af3eb6355cd74d60b8112b
SHA512370bfa324a223daab3db22465b15e3fd66122b1163b002dbef9033578951b893b2a658ac311203fbac2d65c0a1ac1b86ab4093f55ec2c4ef645f8773efb05223
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
1.5MB