Analysis
-
max time kernel
113s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-12-2024 00:31
General
-
Target
95cba0302f44a33d39ca7c47c903f3ab78457078482a5d934dc895b9b2a3d332N.exe
-
Size
375KB
-
MD5
06fd84ce6df33c2ac493f8d7052082b0
-
SHA1
06612fb6e51084db8fb0c8cb2e658248951cf977
-
SHA256
95cba0302f44a33d39ca7c47c903f3ab78457078482a5d934dc895b9b2a3d332
-
SHA512
faf0f666f89f6c4abf30dc6e0387b49eb35efcd7f1016f76dfa510b0d32bf9d0ff67fddb03a5d186027dfe7419f9785c6ee874ebf3c5ddfa43cb8ff11223fb78
-
SSDEEP
6144:n3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:0mWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95cba0302f44a33d39ca7c47c903f3ab78457078482a5d934dc895b9b2a3d332N.exe"C:\Users\Admin\AppData\Local\Temp\95cba0302f44a33d39ca7c47c903f3ab78457078482a5d934dc895b9b2a3d332N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD546ab4c2835e14591820530ac96018621
SHA12a9f3aaa1a205b9c8bd7b7bfdead523d32ea83d1
SHA256c9bdaddf787f4bddfcdebf095f73229ac5314c895340b708c2276027881904ec
SHA5128cad5b3a715830db390250ff2488334c1e2997fb7e6f3984bd41c421ac76e0b038da47d150321bd9658f3fe26763a2fd2a40395df717af2cd869afe10d7039de
-
Filesize
42KB
MD59a936b35ff40871fceecfbe006412c9e
SHA146172408eb4d8e451855e6afd92449a4e19126f7
SHA256f3373e9599109e1874237d2388468597351b9a79e4953fd86cf10bdb78e66cac
SHA5126bfe237313a9677a0732f3bc452d3039eb31bfa300cbf8b85a2f35e741c3b968826e6526f8bc3c5b54a4ec7f197ef039a25541f1babb484b3e7876fa28eccae2
-
Filesize
375KB
MD53f7d2de2c94e699a93e899c34b4315f6
SHA18b6635cf6e76f436e7a7b35694ccbb1f943aada1
SHA256a3a9fa8b070f30570a80fcd2c1031f42271ae2bbc38b58a0259271b0d3e33d4f
SHA512830772ed83f25aa9ee0c8414e0f54f7631d44b31c7758d0953486e7d4d6a32b1c7d417997f5d0af90d5f966aed90ad4f570ec8a8649baf50f9aadddf51e5173e
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB