Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 23:46
General
-
Target
87849f1e3d1e02431634de63c1b5ef81eaa8699c4a66c1861f876dbcc83151d6.exe
-
Size
212KB
-
MD5
e4ab43b42f1fc1c4a6b211d96584148a
-
SHA1
cc794d950579ecb62c30ff995051b08916be2465
-
SHA256
87849f1e3d1e02431634de63c1b5ef81eaa8699c4a66c1861f876dbcc83151d6
-
SHA512
97fd0d5edf3dd4125aa60587fce15e06e403ccebf6157253a98b1f9b57ed9f9857f1a4617acbf5f8cca71ce835f5758e5cb586359ed9bbe64b9d4205c69112ab
-
SSDEEP
3072:MGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb8:MG/iVkO20SFgBhxtW9mG9+Umt3Ezjb8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\87849f1e3d1e02431634de63c1b5ef81eaa8699c4a66c1861f876dbcc83151d6.exe"C:\Users\Admin\AppData\Local\Temp\87849f1e3d1e02431634de63c1b5ef81eaa8699c4a66c1861f876dbcc83151d6.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5396e15d0d0f3f2f4518522ed7c28728e
SHA1a2be269071c752e0c04518820d68532cdea7e3d4
SHA2565e12f8193b3fbb4738f21574b45d06cd4acba08a26212c85b16da4bd1bb8765b
SHA5121f51a6586e67cad7d8ee61e9cd5e8d4f54675d2d42fd412f9bb258294e12e345df127c661e980d4f1b37f38b1d71cd8fb390445156ce2748b3af24dcf5af808d
-
Filesize
212KB
MD5243c21bbafc7b0d21d0324f2e95ad106
SHA1c2ed80673c77c4bbe3f5e4a47162825435803f77
SHA256b204fe9e7dab06f53faaf37b9dec4f463fbadbc2e091b93d6ddb0e44bb255561
SHA5124fe768a82a1d29d32c691a4e2b187f031ec8311459ed6d4f04490ffe11e101ec064c86b7b4f2d985f6f3e9ef26d907364865b198093722e1ceda2af1a162762d
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB