Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 00:49
General
-
Target
82c1fe3437dadb534cf025431cb6a4e2d3811591289bf751706ef49a8a8b9a52.exe
-
Size
355KB
-
MD5
081ebc2cfa3cba92f821635a4b8430ad
-
SHA1
e174ffe66bffcdf9cd29822a1b1667e24e5af85e
-
SHA256
82c1fe3437dadb534cf025431cb6a4e2d3811591289bf751706ef49a8a8b9a52
-
SHA512
a8e26968aa259ef9c2ceb4ce9ba7ae7ecc7ba4313e0d61808cf660f239ad49acb9bf9ab30b3aee41d62eeacabb06fc0281e01724dc428738e063b360b79619bd
-
SSDEEP
6144:TP3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eiy:QmWhND9yJz+b1FcMLmp2ATTSsdy
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82c1fe3437dadb534cf025431cb6a4e2d3811591289bf751706ef49a8a8b9a52.exe"C:\Users\Admin\AppData\Local\Temp\82c1fe3437dadb534cf025431cb6a4e2d3811591289bf751706ef49a8a8b9a52.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
24KB
MD5c784e4fee77540bec4effeb03a3e7c31
SHA11537754334d50be070f1a7125b81971582158cd4
SHA256d637e350cc0bc1d2cb0a96af99b7a365db326d5c3438f5428d8057ab7fd0fbe1
SHA5127c9e836597ddec1525101d37ec3c359809516047025530ecb086d8615dfceced4d3d7533ad8be0f803cea5ddd4ba594c878cc1b16e7a50d1f0fbd3ce72c790bb
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5c112aa46765848f660f3712d8859f41d
SHA1e3ff3db2fe9e16f58daeeadde3d7aae20b668007
SHA2560e7175ac3b17990a528a573e06f7306feda17053c7db0059a83c52a2643b1449
SHA512295c096f008a7c208cdf16e1e7dec4c6c08e26f7483b36fa370eccb3925f110340e15c06a01b1611b69831cd993cc6be0aef4d242257e68520523c727e5e7ac9
-
Filesize
42KB
MD5fa732c0224d3d47a9dfe0080cd3a6cc7
SHA1125ce98883a184604de51df696fab273aacbfbca
SHA2567a0da72aa5ceb55e9375baa52d45b9775312b906e73a685fc7a01954e2da0a3c
SHA512c1f96beb6fbc661414e41fb302a4f0a74dac9506fc1c94f5d61d6caaf18cbb729bb76490202861fab90ebeef9801859cbe7e9bba9d7ea773b7edf053fbab2607
-
Filesize
61KB
MD5e298c94e992f6470d4c58cbee583e00b
SHA184e3f651fd2eaeed4c2d80721ea5aebd28e6a017
SHA256c3c22e2dc44bbd567103e4a02979c4f0fa6b98884b2c01efd69b6bc8eb7bd2b7
SHA512a20ce2c8602b4290d7f3287e888a9689c12d0945e3fcf924f93aedd6e7282520f01db254ed79bfa3d30fff5e4165cf27dcd36db6ffa571dca40365f24bf34472
-
Filesize
355KB
MD5c10b1b2b13d819a8b0dae8f96f0ff198
SHA1bfbf6e22e3884c620e751cbbe7c89195c970575f
SHA2566530a0736f7f1f268ba1b25e3835865d47da2783d99e40dc1469243e72277689
SHA5121343b80b03cd2b5b738216ff72ac0fa32c1b80f21627f7800ad464fc8930f17d77bab35314163fa668c226f60dbeb535cb4de46e5e57284b2ef0760964ca8b3d
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB