Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 00:32
General
-
Target
7ba0f13871dac488344f9dc41b2dadbc140eb5b81025aeae22f0a92e224a5c54.exe
-
Size
204KB
-
MD5
a732e08d1af6a0a6bdd8edfa5e6313df
-
SHA1
f3b7e8f81ccfdbc6980a82e84a4bc70168093c6d
-
SHA256
7ba0f13871dac488344f9dc41b2dadbc140eb5b81025aeae22f0a92e224a5c54
-
SHA512
6ef7db26e4a1c761f081447113bef0abe97fd0b92fa0cadea8e28651acd7ea5b2cc2d58a9c311617f2dbc782b1e2ad4618f409d7af06e4c09cc5269490f4c0ec
-
SSDEEP
3072:k5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAQ:kLexkuRaX41xoyJV65gzyZko+uc
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ba0f13871dac488344f9dc41b2dadbc140eb5b81025aeae22f0a92e224a5c54.exe"C:\Users\Admin\AppData\Local\Temp\7ba0f13871dac488344f9dc41b2dadbc140eb5b81025aeae22f0a92e224a5c54.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5d1d86f295bac8cff8d04d51de0c9eb23
SHA1fc12c0b709e80926c5dff862f15bc022ead5948c
SHA25657b8a27813fe3bb18512bf9fd8f6df2eefd5c882770ca13854874906bc82bd13
SHA512efe64eb83d844162f2ce01d667b86d4f72f76e48ac7d22d0c0c6be67173a9804275ad73261cc90c18d9a74a986ef65729fb1b90d7114b278dd9838e1dc0a479a
-
Filesize
42KB
MD52614623e847c699a5a6250f3cc9a260f
SHA1592385e5734d678e6a9d0791c8f18a7c6c6f20c1
SHA256805fbdcda31509253c7ee0287935b47604adc046c8795796491dff1a0b921f98
SHA512e2ab1b682ec3c4f81a1f1f2918b21aa5efdee6a13580d280b9f722de0012c21fe0619ea1c018ddb2ccca4d5fddbbf1c9e773b20c32fd34cd032a3a70b5ecda11
-
Filesize
61KB
MD5afd40f72478215b341c8a4458702358d
SHA1764f072274936e1dc94fc2c90e6492baf4eb7f9b
SHA256ca6b006e758561c26f9641ae1534e85c398b4595e7705492d15585a133d7f5b1
SHA5124d101a0cad339cb6a2c7539e2c8a87ee72f190c70a653a71d928e0e5cece24c7f83bd19d5f178e93b9feb50f93e51238b78535bb4ca68a79be74683f4ccea910
-
Filesize
204KB
MD571471d9bf18cb78d4e4cac7902d23fc5
SHA171aef21234abe86646bb973e136f84ee031ca613
SHA2567539ca714143382c75baa117683521d01a37fbedc13dd020057f4c9c48166fd2
SHA51295db21fd2d2cc22232e3b5feea695c32165d0cc79c453d65d06b513d82465cb53253a5b1529dbe1885bcf80d0385323cc4b28cac27424d4edac58538ca3b03a3
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB