Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-12-2024 19:59
General
-
Target
1d52b560d54ddbd69dbc0d5221a5d14e8a876e7a1beab79bcee0159d2a0e0818.exe
-
Size
218KB
-
MD5
13b4bdc15103969af8e151377ea008ce
-
SHA1
09af5daac16ccccba3166c2702660502c4c628a1
-
SHA256
1d52b560d54ddbd69dbc0d5221a5d14e8a876e7a1beab79bcee0159d2a0e0818
-
SHA512
5f48a49522b17c54bb98f4f49bd9579a8e11c90c57f8c8574ce4b89fbaab2953337c8b3b8b5817e7c4e7f0957ded6d39af1826659e74c7322dc40b882c94367e
-
SSDEEP
3072:wvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:e1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d52b560d54ddbd69dbc0d5221a5d14e8a876e7a1beab79bcee0159d2a0e0818.exe"C:\Users\Admin\AppData\Local\Temp\1d52b560d54ddbd69dbc0d5221a5d14e8a876e7a1beab79bcee0159d2a0e0818.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD52aecb334332e2eab6c5d803cb60d57d5
SHA10a98d5dc27b65a7acca6d9f5d462acc00e71f41c
SHA256dfee21532a8871c6c313e88d2f83a03ab27869e6847dd50b73559b84ffe08374
SHA512a3431db8e974d31b55780e6be5a15847cd5a2a097dfef8af973413e4adedb51dbb01e02b7c1654b2a9f738837ebb6637c2874f130706d2081099107467ca4639
-
Filesize
42KB
MD5a2d0a573ef910ca4a5b565ad3840e9c9
SHA12787ff027cf942bceea8f297983593c35147ba0c
SHA256bfb67f1e46978ba6e4ea980704637cbf7eb635fd8301c3ab66db8774b332f61d
SHA51265519cf64849025a1785566be1c5c660b1fa97a762b05cc14596f71ce5ea66f053712a06e92918f403f1b2290f30711d06d7e3a303dbfc5eab1d60d7e24abeef
-
Filesize
24KB
MD5897b26a18d1b521b6dd35464b358ce7a
SHA1e779a4048973fce2269a0dc3b75abcf5a8bdda5e
SHA256d0dd096a151bccdc217a3a71d8468ae01a836f6b2af4499aad632b76c8d4d59f
SHA5123601fc3ed84fa3cdd69220d72975e614aecc360d88f8dc585d529246fb328041064864667c4658a81831a1b3974f46dc78635db15f3407ae3e2eb474453ad11d
-
Filesize
218KB
MD54e3a70d9d3ebb99f8350985cf406e9ca
SHA1a7ed89c1c62bd6e05b1e3ac8a185da215b4c9bd9
SHA256b47b92b5c09a92f7433a70dc1b2836151b9b128e16368bb609f2e42a55614cda
SHA512a7c50875fc8e50f422efe6b452f5cfb1cf52d21aad5739fcd06262f696c245ee3421e08f724e4d4f0888eb606a9fdbbe6e54b2b5ce9569062d92d6bab94c2c1d
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB