Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 19:09
General
-
Target
1e783215caac22f314f4dc26ceb8a2c073d41a9ee98a3b5c4cceb7b6f217749d.exe
-
Size
218KB
-
MD5
be16c638b27fb49476824d3591b73606
-
SHA1
26b59446d121192d2c2271a5260a4a36e0bee9d6
-
SHA256
1e783215caac22f314f4dc26ceb8a2c073d41a9ee98a3b5c4cceb7b6f217749d
-
SHA512
796bfba7186ea45f553de603c6335d7b3375cd0538b16723501fb5780d3bda28d4bf5cb87946743dd7103a26a09d45d504c7ff5e5b3ee1ba61431f582a7dfb48
-
SSDEEP
3072:mvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:Y1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e783215caac22f314f4dc26ceb8a2c073d41a9ee98a3b5c4cceb7b6f217749d.exe"C:\Users\Admin\AppData\Local\Temp\1e783215caac22f314f4dc26ceb8a2c073d41a9ee98a3b5c4cceb7b6f217749d.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD51df1dfdcc8e093b8c1915000f405dd0f
SHA1270933fcdb8d26f8b52cf1ad7e66a3786e4a1049
SHA2568c80f334c7f5b530f17e0bd32e526a8ba8866624f8f31ba58950653f3c1e51dc
SHA512854a061523168b808fe35f562bc7939c636054fa1bdadb12199d4100849de9ba1d97a9d02d15b76d238bc9a72c8d25929b1b84b735ea0969f9f829680d576c27
-
Filesize
42KB
MD54dd4085e77f0b482ceaf4c04dd71f2f1
SHA1c4befabbe43bf798e4b40bca5c6ef3206a2e6f16
SHA256c2175d7993db5d6a7e0b74daec4d5f03259406d8c1240b44cd4e039833c8bc22
SHA5125839f4eacbf221965b24ea8159aa6758f4487f468c334651f47e24a7242dcd9a43b44f3168a397b225b082cf52d70ef11779979e4dce28e19867499c0cf0b954
-
Filesize
218KB
MD5f178619542ee4c57cce550db75ac79d5
SHA1cfddab51ec317b5fcab28cdc6dfcabf630122d4b
SHA256917120af464e6eb0b431276fe89feb83f3d203ef11d985adb5a055e798ac007b
SHA512717ae3d9c0ce2ad350bb8a80a7bc2bd1de533301168c02e088fd2bbba36118082ee9b3d74b01b22a92cd2c4a231d4519c09c841944660858c5fdd159f95386f6
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB