Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 10:16
General
-
Target
884ee87c1b5cb639c61947bcb79fdda9f9c9b3db0517b4d5f132e9d7d59f4311.exe
-
Size
218KB
-
MD5
90f1dfa2d37974def11d4bd49fa2c334
-
SHA1
423993073fb5f841eb34e94c1685a06d0376a8dd
-
SHA256
884ee87c1b5cb639c61947bcb79fdda9f9c9b3db0517b4d5f132e9d7d59f4311
-
SHA512
89323b1b39b00afc174c793f0782adc5dbf942a06a7d15b082bf2731a016e223b5db48de8fa1272f0f55a46b48bd67ec8b137e3588faa771d470487223e4653e
-
SSDEEP
3072:1vm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Ha:51SyAJp6rjn1gOObn4b6h9x
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\884ee87c1b5cb639c61947bcb79fdda9f9c9b3db0517b4d5f132e9d7d59f4311.exe"C:\Users\Admin\AppData\Local\Temp\884ee87c1b5cb639c61947bcb79fdda9f9c9b3db0517b4d5f132e9d7d59f4311.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD506c51f61d6cb6af9cdff148fd5edf159
SHA1846f4612ad4a44b94f6a0f913e1259ed52b7d6ca
SHA256d2a54f1c4ba138bd8abef09a4cc2c9421f499a4ef4ea9710a4e742a49925d684
SHA512ecaecf53d885c3ef700eb193db8af51a33bbbf9cfbd2ab7dd98aa3b559690bff4b091acf58ce4db4bb2fe8db84809740b4c7344c146e56a201dcff2003e7e7fc
-
Filesize
218KB
MD536b96f95f0c56f5d3c7951fbfeb30f28
SHA131c164e4350fa4dba19b43bbe66dbc0fd99f90bd
SHA256178b12b98d4980071b416f3cff2b3540ddbaaf84aa4566021e9d981c241b94e8
SHA51241188dde85b5a3963c66a8e1921650c7174279f55fd73243bd01de21180bea04004305b086d0aa003684dc44c012983391d33afc646ac70e4092f981b76067f6
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB