Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-01-2025 20:17
General
-
Target
3f6cf4e904c3d2906f75abfa814d143c23951d807e2f9b8c2d56623d01d45683.exe
-
Size
218KB
-
MD5
de76101aa15f150bf0893b9af9190030
-
SHA1
cf85d8b5497f80bc78b386da7e4b0d9c80674849
-
SHA256
3f6cf4e904c3d2906f75abfa814d143c23951d807e2f9b8c2d56623d01d45683
-
SHA512
b58d6ae5cdbc44f9559eb30f04ab654a4b16a81b5e58c5857a2dcb8c948be8c5a2e5156a44659d849ee09d2002d5fe96c8f398e23497bbd07d481cb23b0e2e21
-
SSDEEP
3072:9vm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:x1SyAJp6rjn1gOObn4b6h9B
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f6cf4e904c3d2906f75abfa814d143c23951d807e2f9b8c2d56623d01d45683.exe"C:\Users\Admin\AppData\Local\Temp\3f6cf4e904c3d2906f75abfa814d143c23951d807e2f9b8c2d56623d01d45683.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5813405f26b851d3f5d99af743b3bf28c
SHA1f6af99c946b2917bb7428e02da1e008d95392f51
SHA256484091cf21abe57bf284a5bdf615d2234f2aab72adc594da39d7338d3f5fc603
SHA512a3c324f9bfeae302c4941e172459632c77574a1b4367758ab6ce0c30c41e3e4b1573900e31d6291b7eeb9cf9fc709405dcc51d74b70f86dc4d61f191431e277e
-
Filesize
1KB
MD5c6685f9b2b74242ba950eb57968d3f30
SHA1f95220747572c916bfdc60a0cfa80586de34c7cf
SHA256ed8cc9a5eeb554a47f25d2cbaab5b33d911e30d122cd42d71051dae7460a1f13
SHA5121145a4ba0c34e9264b32a39001f5c21453268c53d9ab1860445d3904559b69114363d8e72ae2ae6a2e185a3c6adde50fb2f032aa43eeb5841beda71b4d4fd51b
-
Filesize
218KB
MD52779c148192fe4ce058caddbe9ff51ce
SHA103d8f4f082291bc1b56a8f340387bb3033467cbd
SHA256c889964bcd267d86a40dfdb1ae148da2456f3d200746f494a11ba5e553248b35
SHA512375379b7b94eeb82874b793d40e1196756f402032996e0314e920a45b2517e2c9d97580192e01393ec571d8ff6c1320c448d957da4400b5e8b72020e2c51165a
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB