Analysis
-
max time kernel
105s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 12:04
General
-
Target
697cba74fa578745eaf984b11ea3c21b3c7df7dad9d0bf04f34fff993e414b4bN.exe
-
Size
686KB
-
MD5
a47bfced1b5cd240c8caa05a4d6a2aa0
-
SHA1
5cbf0259e4b633ea4182d34904cbba521da89bd7
-
SHA256
697cba74fa578745eaf984b11ea3c21b3c7df7dad9d0bf04f34fff993e414b4b
-
SHA512
06741ba129757ca8d9cf52e8e7f4f4a3ad7b573e7072e4473d12dfeb5305f147239fcecf558f5f4adf41585f2d1ff6a01431051442a55dfa324153214540fb11
-
SSDEEP
12288:dmWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgp:dmUNJyJqb1FcMap2ATT5itjCYZ3DSo
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\697cba74fa578745eaf984b11ea3c21b3c7df7dad9d0bf04f34fff993e414b4bN.exe"C:\Users\Admin\AppData\Local\Temp\697cba74fa578745eaf984b11ea3c21b3c7df7dad9d0bf04f34fff993e414b4bN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD56e9ba8233ef5b34794d42a3918eb6e98
SHA1bb17eb9b0be91ef9edac03e6c8ecf8fe0dfcae4b
SHA2565fdebf9df2c267913ed7e26142a2e99c3aa01dec867324ecdb573a292cafa04d
SHA51223f8df966d44852fbeec6a066d3a9f4e768c19210c873243346b2d8a5db1b7a52ca097bc1fbea936d818a9dedc405c21186099d7e44fb6cb4410899e89f79e9b
-
Filesize
686KB
MD5461548144f56e289b77c1e77224ba313
SHA1a4f66b2593b50ac140fef71abe936edf38e040b9
SHA2560abb82ab5e2805dbee006f4c334c9f6c554f5cf521554660cdd456122c2703aa
SHA512fe59d392e19bb3cf9825368ad627836baade6bcc4754c6010a7c23fbce883e8e988f8d35b547cd4a89a526297ec2b52853b29aac1cd87145448673a5fd5b2135
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB