Analysis
-
max time kernel
105s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 15:11
General
-
Target
7b99b655e16cc9aa1f6799f7ad990e9d1a175345e35738d053d87d65e2c5aab5.exe
-
Size
576KB
-
MD5
98cab5aa9cd9669ee9f2f8527ca8aeaa
-
SHA1
db96d67bd58cae07c9f205e66154a07a879fb359
-
SHA256
7b99b655e16cc9aa1f6799f7ad990e9d1a175345e35738d053d87d65e2c5aab5
-
SHA512
10259e4fc7069ac3bdcab1217c30229aa79625ffaae8eeb7001ca5db6820e014f539504640f0663f66a31c7c75e62d8668b26ddd7c3455538c3842764c7a2654
-
SSDEEP
12288:2mWhND9yJz+b1FcMLmp2ATTSsdxmWhND9yJz+b1FcMLmpW:2mUNJyJqb1FcMap2ATT5rmUNJyJqb1Ft
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b99b655e16cc9aa1f6799f7ad990e9d1a175345e35738d053d87d65e2c5aab5.exe"C:\Users\Admin\AppData\Local\Temp\7b99b655e16cc9aa1f6799f7ad990e9d1a175345e35738d053d87d65e2c5aab5.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5e2354e3687f22295c697365142622fc6
SHA15f5f09d7e4b971b7199aad5e2d2a6283ae663297
SHA2562b8e41a9f30dbd8f8cdec849af01ad8454366e2b6ccdad9aaabb5985cbf376cc
SHA5126eb40afa5f997c7691d1b3c3b0b35adba22fff1c6a1dd305253d9a22038b4a6916754f2a4a6da066e586147b841e4f952f300e867dadcbd6a3caeda4883746d8
-
Filesize
576KB
MD5705a8d5d5ad4ea59af8ae07a6fa4cc04
SHA1d30dc54f67cccaeee1ea67da7e836f51a9e10256
SHA256511f378fecb096ba8e009f030ca4d2eeea18f4800dc0455436c30ee357c87fa4
SHA512858c0a67d29faed8e5160bfc57d7f3f486312ee1a3e8db9bbca609e61a90637d4bc0e2752226c6198182c6eb61f49f0bc3391445117b746686d88fd556ad9b5c
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB