Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 05:26
General
-
Target
6f4ba01309eb64770df8587f76332dabf5aa52f5f19ed5b43919005c4829a540N.exe
-
Size
355KB
-
MD5
e49a1d6bba979eeda8f92bf11f624eb0
-
SHA1
7f0cd16a4f5cc5482c6bfd433c84fba365acb85e
-
SHA256
6f4ba01309eb64770df8587f76332dabf5aa52f5f19ed5b43919005c4829a540
-
SHA512
47250787a0fba8c1fd6820e0151cc867a2b328f9db59b95828f930d99cc2b1451f9d25fc490eb01bf94067c604e51368ae533c65f58d85031fd5a7e435965cab
-
SSDEEP
6144:Y3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:jmWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f4ba01309eb64770df8587f76332dabf5aa52f5f19ed5b43919005c4829a540N.exe"C:\Users\Admin\AppData\Local\Temp\6f4ba01309eb64770df8587f76332dabf5aa52f5f19ed5b43919005c4829a540N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5ea9e6e52d3513c8a033e6a4c595089fa
SHA13b13a8ed81a2ee5fb8ae6c64e7a155c02f72b624
SHA256c541f4479fd439a2b85724a5a3e6672a48b316014aebee61f2bce092bc22f716
SHA5128a60d0bc79ca09dd62d2fd4c7f4c9ec6ef811ed1d347bebef25895063e5c4a66249fbbb714b4d772d76d336dfe1ae0a26317a4a37587b016579cbcb9200485a6
-
Filesize
42KB
MD5186c842b154bef0873d674b7a58f817d
SHA159c839601ace735c03c0db19c93feacb5ef8c3e6
SHA256cef4ef9190cd32bd286214aa4326b15eab1b12ab62ab5b46b2c7529f0562175f
SHA5121a2483aaa409c8ca61c378097e867cafac43746960df70b942dbc572823129a5cf344f8699fb57d6194dde95feded671f1fabe361d19739e5c6b6ea53e98e5df
-
Filesize
355KB
MD5cf7d5555209b7a44b6565e35a3163d94
SHA18d2bbe4ae06c227b1bdd757acfdd3ae7c694e470
SHA256651ec46eee39d7cadffac02d7e2b93342181796fa5cdfcfa0ba665f1f33e2327
SHA5126b1340236096abb4d15608a22b3bc4ccec16c35bfff16f1c99028725d92a5a56ec5751b65326662b4fd97bc0f2e2be4a921100fa8fdd35e8470c3ac3a65b23a4
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB