Analysis
-
max time kernel
112s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-12-2024 06:25
General
-
Target
89f49224bffc6e85a3abc7fbabaeb326eeef2b4b782c29023aa2d3e53545ac1a.exe
-
Size
212KB
-
MD5
40eafadec58ed6c0ed9b7f89afafed14
-
SHA1
f3ea12184329ea7bb80b662433bab9b2095702a4
-
SHA256
89f49224bffc6e85a3abc7fbabaeb326eeef2b4b782c29023aa2d3e53545ac1a
-
SHA512
6b55ed947f4e3097dda94c5d9d9bd5df0f130f60a1500af34e31a031fdc38a23bd72c02e093fb9e88b33210e075e6de1e58b16116d80180f43e6db4cff20338f
-
SSDEEP
3072:CGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb8:CG/iVkO20SFgBhxtW9mG9+Umt3Ezjb8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\89f49224bffc6e85a3abc7fbabaeb326eeef2b4b782c29023aa2d3e53545ac1a.exe"C:\Users\Admin\AppData\Local\Temp\89f49224bffc6e85a3abc7fbabaeb326eeef2b4b782c29023aa2d3e53545ac1a.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
24KB
MD5ada7b866d5cbe336a01b98b2d3af3bf9
SHA1389729f96c5fd9e28e236c80dee0c0f8cf9aaaad
SHA2564480e94a993aab88baa36eb2e21a7b775db6bc042f97599e710ae871f14d94ac
SHA512a3d10e52c871bb4d63aed90ae0fb7290a65d24d4b70965c233edd0e59706b411c746a667ac89a9be8e21d61a3eac16e6315073f1458d389e6ba55830fda6cfbf
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5986773bec29d505b362e595bb3872aa8
SHA1b9bd33447fab05d2857cc72f52f296f9e5bfce82
SHA2562ea0df4743bcb9b59dec6f0077e8f98c089a71ae728078098e627c1e0789f8ad
SHA512b092da95248c7ac51f3aa7be43ecbf1e31276bd7f4e436c20a2683f245522da6fc47f67151944346616311c37d5bccf4e9a37c7012c88f9f9a492d087aaf973b
-
Filesize
42KB
MD539eaf2b46c6bd27a5bb4b71634aac5b3
SHA1671bf49c4f1620cccf3a6624f6d9edd305782fa1
SHA2567b8dae8b783ca653d95c40f9b153262e06bd62b8f07e664990b66675c949de2b
SHA51271671a2f893b2341426f01495d7ac25f0a690390c255c45cb8f7430b8a5f0547f98ba7039c0b3b232cd9a87e62b6336dc01cab3f190329ec96d1df089f2f89e0
-
Filesize
212KB
MD5c53e54e67e66c61cc9e210b394c1c5d6
SHA1ddadabee5330fe0e58f52659f281f3e8af9741bc
SHA2561d2ffc228fcc587ba468488fd7eaa3dde99e06c290ea78b2cf1e706770c64803
SHA51232d06eae655a26c8ede1e73619d650ccfc5ca84a4ae9acd772382d69dc9555ce9bba03cf450cab8f20dc4d29521ecacfeccd87bf3362336d5039d4207498524c
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB