Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 14:48
General
-
Target
9e2430cf0d94e70c65625df4e9f6c5466597d213d60b0b10c6aa30151f1b7a48.exe
-
Size
204KB
-
MD5
b65afcbb9fc6101f8c5006033b7f61a2
-
SHA1
317915c927551b7c3fe120f55c42f8dd2797f8b6
-
SHA256
9e2430cf0d94e70c65625df4e9f6c5466597d213d60b0b10c6aa30151f1b7a48
-
SHA512
0ea7a2f2dd9f3c24fd140c978c2c7edb25e2f91a14efaa420d83b3ab6cce0c817e873cfb8373b74321594739a237b33641e75855d82fd0f3d62f100d1f401fba
-
SSDEEP
3072:a5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:aLexkuRaX41xoyJV65gzyZko+ucD
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e2430cf0d94e70c65625df4e9f6c5466597d213d60b0b10c6aa30151f1b7a48.exe"C:\Users\Admin\AppData\Local\Temp\9e2430cf0d94e70c65625df4e9f6c5466597d213d60b0b10c6aa30151f1b7a48.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5a2425abf27edc97a10f7c51826ac9966
SHA154147af9b9c5d3dcaac984918cfab57d524cc7d1
SHA25643872b2e6874da8b2d097dcc06b4efb90e0e9081d013139323cb4a76f9a969fb
SHA512e0ceb71e0a3f83bb04f399efd997586d6a953ae848089e252f570fd9fca61add43b31296b844e3229fee41ae3d70432d205a4169f4bffddf6a1e3ae4a890086d
-
Filesize
24KB
MD52da66b99979a31de69b9de70697bf7ed
SHA12b09137f06c94bacadf0de84514b09e2e14892d7
SHA256ce242c0cc306db3bc5abb0352021d9d7eeff8a07c7cc0c73e0f5ef40126ba98e
SHA51216e55f14dfa1a416866981dee48d9e98e4ee5d14ef2a7ebbcca2fb3254f11f86347cff12d20ff50d5bd7a6f088c140e35d1fe1dd1ea554d4c72ab4ced913a01f
-
Filesize
42KB
MD51572e6f754d52e2326c0df8ee9813771
SHA1a0535574715236ff8ce1388bf4eb9c0cd70f8934
SHA256cd2a2c6f8c0c9dae60d20caaea948028d126b1bf00c25eb9645527a3cfc42726
SHA512492c4a73b47dc3fd0d3b3097b355cf08ae318b69fd415f731b3855e9599e54d2eadb1558fd82b4b10eb4ca8dc5da1add512e9e4b35aca8a80b889f3fca77c9cc
-
Filesize
42KB
MD5984cdf14680f87bb7c887163476e1b78
SHA1d5f31f912a248018995feed6ef2a07926a1fec33
SHA2561a77f1b704035d1195e9d13e5714f9e6eb631244f9afd89464b8da30bcfb27d1
SHA512928b689fcd92a1c810129ef4d1bd4dd6cde7d710d3eb4a168d7f88f4c1256a3bc3a59f2fc6552a8f5784fc6905d2a48fce961008e7b7a4e2a14454d31b2af4e3
-
Filesize
204KB
MD505da124c0efd3b2c615db47c11dc9e6a
SHA1102bbbdb68ff4a52650e18f383db13b193d10a66
SHA25603ec0f15004f24090a4750ac0cdcabb19564bec513785d7facf3e33701109695
SHA512c501844e721f4b931ca5363c09038c6335fcacaecabf2ef5a248ff7fc12763f8b5c15d9127a9f11ba94c4d957b783b88f61212cb26192ebed56821c9ea528b59
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB