Analysis
-
max time kernel
137s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 15:13
General
-
Target
7b99b655e16cc9aa1f6799f7ad990e9d1a175345e35738d053d87d65e2c5aab5.exe
-
Size
576KB
-
MD5
98cab5aa9cd9669ee9f2f8527ca8aeaa
-
SHA1
db96d67bd58cae07c9f205e66154a07a879fb359
-
SHA256
7b99b655e16cc9aa1f6799f7ad990e9d1a175345e35738d053d87d65e2c5aab5
-
SHA512
10259e4fc7069ac3bdcab1217c30229aa79625ffaae8eeb7001ca5db6820e014f539504640f0663f66a31c7c75e62d8668b26ddd7c3455538c3842764c7a2654
-
SSDEEP
12288:2mWhND9yJz+b1FcMLmp2ATTSsdxmWhND9yJz+b1FcMLmpW:2mUNJyJqb1FcMap2ATT5rmUNJyJqb1Ft
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b99b655e16cc9aa1f6799f7ad990e9d1a175345e35738d053d87d65e2c5aab5.exe"C:\Users\Admin\AppData\Local\Temp\7b99b655e16cc9aa1f6799f7ad990e9d1a175345e35738d053d87d65e2c5aab5.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
61KB
MD5d7829dd7b2394fb22cc04cd9b31d8d3a
SHA18dba6920233578d4a3908333102e567b9bfca296
SHA256ce7fbb1cd49841ed6a82d3a2699cc76067ddcb5245b22f0c9df0ab01d209afc4
SHA5123059310dc6b55eec0f0467cefaa853723cac6e1609f3e00251cf1f6863fd7087f5f0dc29736e94542dc076de8682655040f3ba3988be772176acb924e01a4c3f
-
Filesize
24KB
MD5a2daf715facc1c7036205f37a13b4ca9
SHA1d41b5701470c9ed03432d31a65b86f055edb79c6
SHA256dab508797a4367fd7e9820b0ca70caf43622744f33d8f970d7b77c62658c0adc
SHA512d240d6355bd6100f61584ae12af402e5ba92a15941d2420ded927a05987bcb1999a8da64e22925fd84152e83133465d6443b6b7dd0f7954da1db0dd2384afa05
-
Filesize
100KB
MD5b362ddcb6a9167285901faf7a2a9359e
SHA17e195b75620de490f5cb65d774f77f82c4f52d80
SHA2567f2978f347b6b0c57d55444816dce0f9699d939a1b8c4437950ef1dac6379d0c
SHA51219bda4fd52386eb9d4b7800b623e38fe9c66459037472cbd62e0054da0482c07ec53c80f37fa3e9618e18d1e6ad40aab8267822d7f26213f0448efd26023247a
-
Filesize
100KB
MD58c1ed6203a34384ba467457c51a9564a
SHA1054650627459502be0e6da0151c67af08ba97ace
SHA25658e8dbeafab6cf1a6936f32b41b2b50a7cca459200914e93625f12645cc4f12a
SHA5121a6c998cc07d7f66556304d41c3dab54da58b9dde442bf8c05b627dbacae3aa86702217e5549b1ead4dde04b6a53724a62b159928f7b04a2a95bb235830cbcc2
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
576KB
MD51f45ec3e5094caac46b17c25110a6552
SHA14400a4d577b4c9c6d2d34ee0eaec3bdf4ce53784
SHA256d5694b7451c74535bb2059d592c91d34b3554844b0523e866474374484f8b671
SHA512f731818d7005925f1e4e50931bcfeb04e6fbc7157e1055c102ab9777c08900cd06d89e706bc7af21b753e4589c11fe55cfeecc6947d2a506f18479a4f84e12b1
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB