Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-12-2024 19:55
General
-
Target
1d52b560d54ddbd69dbc0d5221a5d14e8a876e7a1beab79bcee0159d2a0e0818.exe
-
Size
218KB
-
MD5
13b4bdc15103969af8e151377ea008ce
-
SHA1
09af5daac16ccccba3166c2702660502c4c628a1
-
SHA256
1d52b560d54ddbd69dbc0d5221a5d14e8a876e7a1beab79bcee0159d2a0e0818
-
SHA512
5f48a49522b17c54bb98f4f49bd9579a8e11c90c57f8c8574ce4b89fbaab2953337c8b3b8b5817e7c4e7f0957ded6d39af1826659e74c7322dc40b882c94367e
-
SSDEEP
3072:wvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:e1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d52b560d54ddbd69dbc0d5221a5d14e8a876e7a1beab79bcee0159d2a0e0818.exe"C:\Users\Admin\AppData\Local\Temp\1d52b560d54ddbd69dbc0d5221a5d14e8a876e7a1beab79bcee0159d2a0e0818.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5abceeeaf4e2e229b4a6590d8d222cb36
SHA13124e3e29e9b6a94551f7a1da0a95a8a67c172cc
SHA25610260485156f015a6acf3694509822be13d44acb855f0a3402259e4f673bc826
SHA5123c88e0e021311c7d1b4ef5ede2f202c016f0b0c76643540d7a9d49fd6aa22703077dbf082c50821b976bf869ed68ccd3a33739ab9fe8156914e4d438c03188a4
-
Filesize
218KB
MD56d46e2c597dbe74e3a41a72491b69d78
SHA180237ca6fe162b26f35be52df81f02e8040cb15e
SHA256b7bcec129cc43119e24fea193e852cf0263bb16776b197a4a2208f6adb60b952
SHA512d95150ca7d764c5e74977b616c042e4d4961604b721b05b07da5159b8cf52adb068e42bf9444ba5ad6123c0db6233e892188ba22e29364ad01f3e11ff358373b
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB