Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 07:24
General
-
Target
9ce951b1b816ea7e2d1e8eed3b5dff1c3406ae04b3fb0fb378edfebbfb3dc4c6N.exe
-
Size
355KB
-
MD5
b49ba2c90729d59b0218d2141bc2a7d0
-
SHA1
b031db8cba34acc7267de022ee2888c7de0e6e4f
-
SHA256
9ce951b1b816ea7e2d1e8eed3b5dff1c3406ae04b3fb0fb378edfebbfb3dc4c6
-
SHA512
99ad7a04f01eec135583f2d3fed989efa3d0007952a798924685fc40a911f72400cd0e94772d8f42467fa55c3727b62142d1b014809cf1b9f1c405f7324794f4
-
SSDEEP
6144:J3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eiy:emWhND9yJz+b1FcMLmp2ATTSsdy
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ce951b1b816ea7e2d1e8eed3b5dff1c3406ae04b3fb0fb378edfebbfb3dc4c6N.exe"C:\Users\Admin\AppData\Local\Temp\9ce951b1b816ea7e2d1e8eed3b5dff1c3406ae04b3fb0fb378edfebbfb3dc4c6N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5fb051e85fa771155f4d1eb6296af5014
SHA187365d1441c06487beeb4921745c9c2a23ca67fe
SHA256e73d222ddfe79b021b6f086e30f8c5521d8a1fc7cbf44c52b77916757f9c0108
SHA51243ad435d9f51063690d89f47505828d61a8367b690625346e111161a09c081ceb3db76fedb22224240c6ee00ff65de77a6495cd1de9ee933a585ac96ff69cd91
-
Filesize
355KB
MD586e85f022cf7e131fc91788abda3598c
SHA1a2420a112e189d188e86b4e2cdb26a3b9c64fd3c
SHA256679479ce338e68618bc7dff2a01917e6b717b621cd0462c2d79ced3e4b79d054
SHA512ec028eede1daaaede120501ab8482fd959ee37755f002f684f8d2527e8ba754748022d02bcbab03ea4496ed6d9f761b3e7bbd36fe51a525ba0f4230d4c010913
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB