Analysis
-
max time kernel
110s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 18:54
General
-
Target
54e92837ef84b1f78d7406c3b14ff0569c178956e7678ae580c74f85672daee5N.exe
-
Size
217KB
-
MD5
b1c062e2ddee3108c436b9d41f084120
-
SHA1
453efb52db828bd19badcdf634dc3886cc08ca3c
-
SHA256
54e92837ef84b1f78d7406c3b14ff0569c178956e7678ae580c74f85672daee5
-
SHA512
b81aa4cb061f4413de45db0a19e7857c79984be2c095c92e4e5c41166c0082a9570c130492784e498e840fa64a38ef6a41f247fcb086ed61bb0ba951b8a1c8c6
-
SSDEEP
6144:UrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:OsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54e92837ef84b1f78d7406c3b14ff0569c178956e7678ae580c74f85672daee5N.exe"C:\Users\Admin\AppData\Local\Temp\54e92837ef84b1f78d7406c3b14ff0569c178956e7678ae580c74f85672daee5N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5fb9d1bb3a37ffd083b6504ba70e41f6f
SHA11d0acaeff990cb461624059012e1bddf12fbe2dc
SHA25616c36e3f2e966cf4e7f8758dd4ae4b7c7da771dd6374d331d1a0f81ebd0e78ef
SHA5121ea182609348af3f90ee5e7059fa727e194d7207d6b6f4e302a1df48baccdb38351caad7ea5e1a38d20955a255d20a4f755e04b95d442ac8165d685d63e397fd
-
Filesize
41KB
MD50b2edfa3e14cc3ccb8caecfc41367cce
SHA1480a7c580a12755c712fab9f5f924aee885d1549
SHA2568ca1a011d53c0b1a474bf4ac24aed66660ea9e967c3c7bc4b7b6c02e4b8617b7
SHA512439e9473d91fa7995c506fefe431ec70fdd6b32f0284701afbe9ada5ae9562d43142f38429b2c3a4a197acd201f39dcd3b45ed934fd3d00a16ec1bb19f071e21
-
Filesize
41KB
MD5f21fddc881190578c93dff0375ac9723
SHA1b6cdb3d7eec332feeb586e362d8aa79fd13db87a
SHA2562afe260ef90bbd2baa6eeb2f23b32766485c284e3019f3d851608bb0cc3ab651
SHA512df85a5d3db6c2da1b5deb598e2c32e479caead88f7ed88a86ae6c417cf29124cbbb25e785ebef071ca101a532f6f8eb0dc22dee929bd8761883247ab20334d71
-
Filesize
217KB
MD5284bc212844bc0b987297dcbe7206b6f
SHA1c342dd876981394c259e1b6a7891c22bd8050277
SHA256ac275d84184e851e88bf5d3ce3dfb110a8f08e4cdaded918b72926178672df8f
SHA51212a819dc48815b026c84680f9b9395540ba6d4a4d789cb5b2cb13dd69912f7f3139452427a68ed8bccfd95280455518b04b818e091bb29005718ad1d0b5255ab
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB