Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 19:19
General
-
Target
3e7738d12a4f5555f35ebd0e27897b9df6b01e4d3499e1c8e1f489c35089a42b.exe
-
Size
218KB
-
MD5
7589517ba24bb47f7c6dba00581e1e17
-
SHA1
d3bcf2d105d4d491c7076afd851d337dfd463d96
-
SHA256
3e7738d12a4f5555f35ebd0e27897b9df6b01e4d3499e1c8e1f489c35089a42b
-
SHA512
618fd33db6ace1fa63dcfc2bdeba49a37b152b051723e671e6c463992910d73bf53d8ce2c155241b74aed77425c9ce592096d790cddbfe6e6a662294fb9e63d2
-
SSDEEP
6144:VEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:VEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e7738d12a4f5555f35ebd0e27897b9df6b01e4d3499e1c8e1f489c35089a42b.exe"C:\Users\Admin\AppData\Local\Temp\3e7738d12a4f5555f35ebd0e27897b9df6b01e4d3499e1c8e1f489c35089a42b.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5d1997ca2dad65d111032e4933de7f09d
SHA1993c0cb8c2cfedd8fdd3609dd9a38ac29d973c0f
SHA256aa4ed67c4924cde200f0813d1262ba1d2beba255a1891236d24d1507e1ecdc13
SHA5123706c2765536ac778e1f8bca0358a2b85f2db85cf3513ef8683fb1cbef74e2edbe4273a35fb81fd15298551af0db35f3019a76d1aec5d3e16800a59ed85c1bb4
-
Filesize
61KB
MD56b559efb2396ad4f51b6563a2d1927f0
SHA11a662b67eb03b5a444004909090575b28a77c4f7
SHA256ba0bb3e51fbcf566afbf890ebb6ccf288dde753a32ad2533457504b1752576b1
SHA51213a1cc8112bd5db8f86b377a2a85128e2c18619ebd0db1f4fe40f7795e75803bd06af673f78586dafe9c89fbf3f9148dfc62d08be7029cc169dc3606a5cfb588
-
Filesize
100KB
MD575100afb24a543551d2d3f75dc8209b2
SHA1d7d8de30191613a9a0c28d569d2775295b1ed253
SHA2564800afcc1814af1b49cb912a74be660cfeef783103fc535a949e1748c84b0ed1
SHA51247a7abbb434ea52b32b1afdd3acfbc83040af19e0ddb06c8a60bc861394d41ad85b5c983bb052be52848ab00f515319055e22d5115a69416e89d69e64c9ace84
-
Filesize
100KB
MD51b9303b93cfb414dbf358730a6110296
SHA1c1c6e3acf6b4e8fa2978e18f462c2709fda6497d
SHA25688d51e28f66998cb5faaed338a35458aef7c40d506f204a59e087f282dbb1233
SHA51261ba0bf202d51e02e02674cd9c8987428d9802eda05ee287fa841a6c62726d27530773ef1809ff6d39bd5556646537e2b2f77c2d30b3ce845af7a2905a4b36a0
-
Filesize
218KB
MD55831c9f6f7a8adf1ec7e15f2a60360a8
SHA1104fe4d0286899d5640b66a37d5fd8a4166ffe61
SHA256df3c69ae521805c211a2628b77066617834c02d3f71a6c78d21d6398208f7077
SHA512bb4610e79dd803ea5391809e1184160d8a456394769d7ba2afafa38e6379ac82b639630794da79f647664c0ef8d0b141c9aa912d4dd9f8a2283d926d8b301e2d
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB