Analysis
-
max time kernel
111s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 08:51
General
-
Target
54f40ed433f4b70aa5986047ac86884145bf6b28c0f8f4bda3db0bd310360b29.exe
-
Size
212KB
-
MD5
d3ac1033452e9a0e5bf6dd3989ddc05e
-
SHA1
c4089a8245453b8d6b561526ea03baf6343333ed
-
SHA256
54f40ed433f4b70aa5986047ac86884145bf6b28c0f8f4bda3db0bd310360b29
-
SHA512
33bdb585712e72aef2ffe9179382cbdd1bf23d7e578a3f35540b599b013eb19e846985ee62569870e145c7bef23616474791494d7754b295d76d3a8f871f967e
-
SSDEEP
6144:Lob34ERMS/H7YAVsobrVn5G4E3Hi96mbQzJWFO8Omw4GZ:MboEj/8ASWM4Ki96/zqIKGZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54f40ed433f4b70aa5986047ac86884145bf6b28c0f8f4bda3db0bd310360b29.exe"C:\Users\Admin\AppData\Local\Temp\54f40ed433f4b70aa5986047ac86884145bf6b28c0f8f4bda3db0bd310360b29.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5464b17298ac0243117ca0f1b1e16fdc2
SHA10f6fead02d7069966502a4004aaace425965d59f
SHA256f96089d6476d6f2fb4ff7174abaa611ad16831a722b58c6e681d15620b10c24f
SHA5120ef57909b743c975f390f13541e1bbf7823df9417931d639348e81399d78fdab52a57e0c628963eb83f025a1912a38e1c35b0f4d40977605e49353c77ac26754
-
Filesize
61KB
MD5068a69f453ee244e1a5bad75f3b91159
SHA16416436ebedd7deb7e981e6e5ec8bc1b39b9dab6
SHA256675851dbcfe58c248efca9fefd6da674025989939458ae7304a25a3cb94dd9d4
SHA512707168a2dc20911546b874ae245f709fc035a4609b80221ab63379738933a94fbb70f56995d0a49398e4e19db4664a0bdbe6767ad3927861aea7ddcae73e2697
-
Filesize
42KB
MD589a202ff755523bd7763ecb0d2aefb0e
SHA1dacf31ef21da8c82917e90355bb00915b584e8e3
SHA256a0d041ccb664926fe40da45388301bcb89748f724f9caea4d3c4c80ec4f8e661
SHA512054b87b13beedcc04d344663544726a128a322003b891335a1167091e6f59768a17e22d22759b7dbfd77771fbd9803950fb6541dfbc3c896f927e2bb838d8191
-
Filesize
42KB
MD5a150477433c6080d3f466b9b6510b82a
SHA18415a2c507fe92eabebfd7236b3f9e1e8994ca5c
SHA25604719a4ee4c44b8578053126841ccd0c7a16e859539b80004e06dde48fb7f901
SHA512a2472c4bb07c5d9be8ae02622920b079be4644331edf48943c3d89fda2c4609e9e71208b183b35c62c8f5fb9f9b69a36cecb712d7f889404ec690ff98878ccb7
-
Filesize
24KB
MD5635b69b2e7993de4c6cf209d79a6cd89
SHA104f066618bf15cf8f28f3a4e1a27c8d432b33e85
SHA2561b3c76230a640134beab9981d0f4efb82ff6188bfad67385cfbf6cb7f1ed2188
SHA512a49294cee1e62e65e27e720432ceee5befac75f464fa4cc1db5eeba0d292b57411f9465979a7f6d12199ca3a4e139dfeaf80741a11e77633cc1c664cc3d72b66
-
Filesize
61KB
MD5d29c03113ccc88acbc12bd70784c93fe
SHA13363c0d3c89fbad3abf00786384a63c4774497ad
SHA25630dce16d25f6a03bfb2f224cc6545b091f41b240ce3c109db6b9cdac1babdc45
SHA5129fce2217ed5454bb9acc100f9d3e435c7d69955f9fcc4d8e3662deab41446ecf8b2f8be9601707f0216509a6631e6df322eda2e33f56fba33b3642aa63ae067c
-
Filesize
12KB
MD5e1f035b24ce0e8137682b703d19315b5
SHA118712fd6ad888c146237d187332ccc904ff1f032
SHA256117ea4f0f411e1aaeab307c087a57678abcba7e6aa96a5bd1f2d5d7026d453a0
SHA51217a428fcea9d064e8318f0ef30da88c713209f5d591d2a4e9725d56663acdb96996569693804071aea17ddc793eade219409c4548e48d1ddc8814662236bae7d
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
212KB
MD50af2e3b9b79a5fd5d56580460632b08b
SHA17d55ac98486a61370ca78a12687f9a115bfdca8e
SHA256de085aebb78a32f2e7fa7315b2f06df989507a25d6a4181bdd25276f4e79b4f7
SHA5128e4be6fbecbb13685763f9d7e6fd65eba94e5585ccce2d7c0d0963f4dafd378cf1df8f4a7426fa5e4dad45e71e2f18892d26f957f16808d17a42a7f89ec4e5b0
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB