Analysis
-
max time kernel
108s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 15:49
General
-
Target
1f0b021aa165a1eb667ffec4636d361b87f4f55a6d43429b70c76ee34e8cbfdeN.exe
-
Size
375KB
-
MD5
c34e5178206e3a28a7df73bab7f5fa40
-
SHA1
a05adfa4a1dba5a49ecdc29796e53d0fb36a2e96
-
SHA256
1f0b021aa165a1eb667ffec4636d361b87f4f55a6d43429b70c76ee34e8cbfde
-
SHA512
42f1caa43ead2efd4830dc7fdeb16bafa2a5a7b9c3e874c6a98d9920eae41706bc987a3740594fbdbddfe31a756742d49e283cafeb0494a791355f9c084ad987
-
SSDEEP
6144:N3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:imWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f0b021aa165a1eb667ffec4636d361b87f4f55a6d43429b70c76ee34e8cbfdeN.exe"C:\Users\Admin\AppData\Local\Temp\1f0b021aa165a1eb667ffec4636d361b87f4f55a6d43429b70c76ee34e8cbfdeN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD54185e2535b221ce7b827801fae31e6ae
SHA1ea21c820491191b7aa6f9e6619fbc74bada114b2
SHA256e935b02a0839c98a4941b743d808e01a081a001f9f9be73a15f6c5f266f1cc43
SHA51299c1c41452e823d5a14640812f4a1051e8a5477f878fb245bd6babdd96c0f93a83de65d3c0e5c7145726590a5e6227e556e1cd6d4b9479371cd6d6277f82d096
-
Filesize
375KB
MD5c3b79c978a247d9e6cfa65d81dd52cbd
SHA12ac6d43048263e90b8f59e632633ebbc9594148c
SHA256fe83af6a0d42528ac82a253f36cd544f1ec3ba353fed50744862110dcb6ca71c
SHA512b43d8c0bc496dae748358d043606685aca8b775d01065660e15ce450eedf79701822eadc83766bc5fafce44b2e1f34f4bf91738f7cca33bf6dc6e43f717b52f7
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB