Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 20:40
General
-
Target
317e1fc9ae3a6c277f074e3feea78daac6cf28a1dc262bb1206811f0b7a50d84N.exe
-
Size
355KB
-
MD5
947b5352b4974069fcce9fae76451c40
-
SHA1
c324827ed33bbca835ee83ad05bcc07ffeccd70f
-
SHA256
317e1fc9ae3a6c277f074e3feea78daac6cf28a1dc262bb1206811f0b7a50d84
-
SHA512
c243cd54206a70f4000ae454f160cb71bb0fc7a132e0664eac85cc262de5100837558bcdb057789eba3629f2fe4fcddbfa618f0cd1be892761e0f46ea3a85ab9
-
SSDEEP
6144:V3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiW:6mWhND9yJz+b1FcMLmp2ATTSsdW
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\317e1fc9ae3a6c277f074e3feea78daac6cf28a1dc262bb1206811f0b7a50d84N.exe"C:\Users\Admin\AppData\Local\Temp\317e1fc9ae3a6c277f074e3feea78daac6cf28a1dc262bb1206811f0b7a50d84N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5fbfb466d6fe46eab0972ceab109c5a59
SHA11040f3d482dd305a1e9baabfe25313884843f7dc
SHA256a566c4c782aa45697e54268c0b4a1881bcc3f2eb6002e9e79a59b03e5915b66b
SHA5120f847dd6e5c5ad67b67125ef6cbd39fbe3618857add02aa6701eda8689ef3e772dd4637549b4b1c349b86dd7d9387afce60995b61c4d89efbfece7906b81a208
-
Filesize
355KB
MD52b3d71ca23d8f2042836851b50e991de
SHA1272f996ec9726a44501ea6ce741eaf6d0e7446c2
SHA2569ab1bb669c795500494fa5fa7ad175ae29f3e4d6b868ac3eabb3238b08bc208a
SHA5129d6a601098a9fa2f6a9ae3615623fa48b4736e1eb9ca9fdec254216198c59d939c21f059d1f80e02a89939ba7fde843528521ffea08f02be39a2e2efb0daf926
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB