Analysis
-
max time kernel
116s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-01-2025 04:05
General
-
Target
61db1ce150831d33f5a64a8168eddf580018923aebeb6f2d1ce2aa1bd9a49bf8.exe
-
Size
212KB
-
MD5
f7ea7f1dafe306bae57374ab6d3ba002
-
SHA1
da172bf6fcff24508866ea3de85b2774b9aece20
-
SHA256
61db1ce150831d33f5a64a8168eddf580018923aebeb6f2d1ce2aa1bd9a49bf8
-
SHA512
266c9131072c291568ad88e95ce02c5b804b7da258afcbe07cc8d0723b265022a04cd8eb7175032c0c8e54927c05999918ef5df8b00d7e8341fa1bd758b8e719
-
SSDEEP
3072:YGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb8:YG/iVkO20SFgBhxtW9mG9+Umt3Ezjb8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\61db1ce150831d33f5a64a8168eddf580018923aebeb6f2d1ce2aa1bd9a49bf8.exe"C:\Users\Admin\AppData\Local\Temp\61db1ce150831d33f5a64a8168eddf580018923aebeb6f2d1ce2aa1bd9a49bf8.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD52c70a701164067a1295d4efbfb0acc45
SHA1729da66cbd0df74edd71568d7470a551709c73bb
SHA25678d0be8aeb6f7e3cd98dceaa86075bb74438ec74ef496bcacbcb9d55075fe221
SHA512ca88ff3ee31283eec5dd5e9757b169834166fb1c7ddbd690d001bb80ee4ff0ed1ef10d222bde3b53e30409a0e501f128cdd313ca5057e8b1c8d1933ccead0962
-
Filesize
41KB
MD571af08cf0c234ef618f1738c01f2b7fa
SHA1d5771272f0da999edc960ccd15ab50096de5c888
SHA256cfda84403e8e5b8df2f19bb0e55c603d9e488ac90b60569a39769f34218748a6
SHA51276fddbe7a47cecffeefb281636d20edd2412bff72449695c3b51fe30128219bd1aa3ad56f56e408d53e3e4f37ba223da04de4c831187a197139b518092f9a58b
-
Filesize
41KB
MD5d0b358f681a837d6bfe02fbf713d77cd
SHA102859d802a8a945e264b65adf138be921ae0cd93
SHA256eb8fdf4bd5f1f064a68bc533b6ba176c5e6a7dfb7b64cc40719ac7e63dd81eab
SHA512af1c9f97eaa9c79479aaeb4e79e9a2bb29902e4529a62ac30e18f082d93fc2a16a3a82578f1e3e358939d1bc5448d128073ce0fcdff1fc1093c33343f33c9e9e
-
Filesize
24KB
MD568b8961001b0a1304d228d1e637ebbc6
SHA17b34db6ab4c9db1779ed1c569dd9b9bae22e8d46
SHA256ac2829ead6f9d7bb2b46641d6df19081fb2ba481f97bfed6f6e372d9136cc2e1
SHA512715a1c2ce651bab0c017967cb29ca15e0fde879a14f41cd755c3d516a2574165e5f7899648df4d62e875c8f65a6dcd9a9cd502f8c7397d2df3bca0cc5cd01268
-
Filesize
212KB
MD50ac4213695bd1cdf3d8af8235ecc8ff0
SHA17833dd5f870573da84ae82da936e19f835c54cb4
SHA256d09558ac824331aec963949790a4aa64517dbc25b151ff0eac91594dea5f4296
SHA512895fe172eab8cd59819c1600a17594464f4d86d6992b6be5e88aba9c15d6547d8d92344a1749c7fc7fbdf4f988948f9361f8b3b37fa075646a77564a4dd2ddaf
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB