Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-01-2025 01:51
General
-
Target
ab5b6f1524420aafc81561f93e0efd43e41bb6b232606f8a7485ff92731777b9.exe
-
Size
218KB
-
MD5
ef7d99aeb035a8a5bbd42e464f36d29c
-
SHA1
2f6e7abc6c999f1e2e9f027adcda2f8cadc30ec1
-
SHA256
ab5b6f1524420aafc81561f93e0efd43e41bb6b232606f8a7485ff92731777b9
-
SHA512
42c3ac66ddf13ba63e2ebf70278777f3f6ec53259627d90bde1c093f8a789ff5a738751a3d764569b9249fad3e64a7628a66cc9df8be915587d5738d9385ff27
-
SSDEEP
3072:bvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:j1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab5b6f1524420aafc81561f93e0efd43e41bb6b232606f8a7485ff92731777b9.exe"C:\Users\Admin\AppData\Local\Temp\ab5b6f1524420aafc81561f93e0efd43e41bb6b232606f8a7485ff92731777b9.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5c89b054a8b6c2ad00fe7ab30675e1224
SHA1960b414c102e70563d58c6527a834d5676b82dad
SHA256efac14e52a874972e6a2ba1de534cb87a174a75f1063b9b5a92dfdf86a7b910a
SHA5129c27d00b88813347c592ca717bd42ad8584a91cb8030c5aee094236b8f64d4d48c300a12e05770881e4718704cf7f8c9a6d947a972a91b2027e1cee71dbc5d6f
-
Filesize
61KB
MD53bb8acc7cfb099aa15fe650eb7d96893
SHA16c6b9d43332aa5464eed36ccc6c2cfbca21f6f77
SHA2563a0c56adfbbaaca98dff087e3e8c6a5bef394ce865c794d19e8c127952b7a2fd
SHA512495cfc8973b99cf21442c7e4fb8d5ea525106c8808260878e4b7685e657421c24813c9b0e5994ecfe0a2bc9ba1e0d68ed50345b424e2eeacb2e5068721395685
-
Filesize
218KB
MD5d0680df7990717ee5a9cce28fd14ceee
SHA10d885d268c36e0f76a8103ea22a479c927112120
SHA256a9885ab261d41b21dcb80d4033d0abc582deb5c3c9bc76fe95a31bf8c8cb1aea
SHA51263296b93cd521274a427919ea0db7570d20a64246bd81398c104a8831548a90a19d84fcce00cc79b0e3f3d7860bb2cd566900b1722bc83d2df7aa3619a501640
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB