Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 19:05
General
-
Target
0f8daf32c9836e31510a30ce704ce28e737dd5e42b479d2efab4fafed440ce4a.exe
-
Size
204KB
-
MD5
2469821e2c490c2ff738035a0a24099c
-
SHA1
c5171f0610321cdcc871efea660c1b0483e89b94
-
SHA256
0f8daf32c9836e31510a30ce704ce28e737dd5e42b479d2efab4fafed440ce4a
-
SHA512
51635343229f95da8ee56b8fd3d2bd31c150af21ce47b00057ca40938fa7eb333668a308cbb6a83800f1db84b64b7b913f8aec07ff515fac4e9581039fcbd46c
-
SSDEEP
3072:R5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:RLexkuRaX41xoyJV65gzyZko+ucJ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f8daf32c9836e31510a30ce704ce28e737dd5e42b479d2efab4fafed440ce4a.exe"C:\Users\Admin\AppData\Local\Temp\0f8daf32c9836e31510a30ce704ce28e737dd5e42b479d2efab4fafed440ce4a.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD508bc4a08e5daee4a2d552b34d826c2db
SHA12fe28690d9b14f197ae4e4906c2e90fd3e886d7a
SHA25660c73b36d2132ced7785dc2495398a36e3c580151fbe1823a1443a473d78b8a9
SHA512b50851206235899d43575dd4271c9d6f9773b308b78163be4fc665919144a1096a3e0337d703f826d9fdd721a797bf46e4c15aac576ac9fae7b59fd2348cbb4c
-
Filesize
42KB
MD5eeb8d8e4a410966cd5f341ba0cb9af72
SHA1b38e32779462613f8218ff6144e929071c424237
SHA256a86dd345f1cdeb81a7a7186489b549ffb895971ee8f5d133209ade61c64665b8
SHA51293b568f09e6ead5f8513f618b1a4dddd90bc094cafd177a898d5bb85f37613bb438bc63d52c8f79e5a390975e48ccf36977a6bba3bb396c7ca7522a81ed4b063
-
Filesize
42KB
MD5f2f662dd62118d95e6eb0a1a923e266c
SHA19fa28497df48718a38110cce1bb6b8cae9b4a059
SHA256c4d2173e31af2d3073f0fc24a091cb58d7fdbb3255ee40e32b644644b9bd5d22
SHA51286ca607b554e2aeedbee94dd91ee83e2621b0472eb0185928566c8bed3dc4214be93acdfcc52e2b3a8b8a7b2de8d402a80a9b2384f1a8fd67d6c53c59b8d9358
-
Filesize
204KB
MD5bcd27b8308d59e62955da613de62c577
SHA10887fcd6b2bfa48aeba06d25e25e7d12c6a761b5
SHA25658dedce0829a85eb257cd8145475c6b45531510f1c61c0643fe24d5d613dd3f0
SHA51254ea942f571fc00c29a9ce9977c0944bf22167e3ee8b6c84b42e616db09cffb9a15b3539564c7a956fdc3c6ba028fa8f156ab7d2f47b5538d5b982be61b59b55
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB