Analysis
-
max time kernel
112s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-12-2024 10:21
General
-
Target
c1d9aa74fbd68912db42704bd086de33675fda0da3ea30532b30baa2f715abb1N.exe
-
Size
218KB
-
MD5
b5cd07db712077148a51169420ffc3f0
-
SHA1
fdf50fd4da113907f642bafd6fc374ef0fd4fdb5
-
SHA256
c1d9aa74fbd68912db42704bd086de33675fda0da3ea30532b30baa2f715abb1
-
SHA512
7c696185500f9efcc83777e8c31c14fd83eb1c2d49bcfdda94a1a9099be073f7baa20092fcac11767cfc6d38be1e51e1e26cc0b9e636453909693abb7d0b0200
-
SSDEEP
6144:iEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:iEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1d9aa74fbd68912db42704bd086de33675fda0da3ea30532b30baa2f715abb1N.exe"C:\Users\Admin\AppData\Local\Temp\c1d9aa74fbd68912db42704bd086de33675fda0da3ea30532b30baa2f715abb1N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD562cf59b05ce152e5d9018ed51daa1456
SHA1e2d76b26bd17adc3cc5cdca1cc1e2ba9b0ce5cf8
SHA2566b6b4a8990e4b5d5eb79117d6e6a93cf99260678164e824b723d3af352fbe693
SHA5126b836b69ee8690ab7f90e5980583a027f2a377dad690efdc43c7c81eac4ff7e1d44182396a2e342413ede4bb5234850f46453898180c23c20d2785383d16d8d4
-
Filesize
218KB
MD556c005de38041e875ea0c738469df50b
SHA1ec6058a24296bff782043431fea8e2bd909b4774
SHA256fba20a8e228d129c3a8b0a2d69467d24900eb010fe63f842f833e976cbf5520a
SHA5128ce4f912296a5a26363b684b4ff492d86668a051cc78ab19a7e83482f8627782314b4141c4ca4ff730dddabef408a19838e3b5a3cf38729fc6bc4ad327bee386
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB