Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 21:05
General
-
Target
6572dffa8610730dbb03dcd705a2d0cdd694abf6ac11bac08f76be7aa9d9ec88N.exe
-
Size
218KB
-
MD5
95f9c9cf1b0094874cd5d59b61b01fb0
-
SHA1
4b88f88353969af245c924877c607cae45a5dffb
-
SHA256
6572dffa8610730dbb03dcd705a2d0cdd694abf6ac11bac08f76be7aa9d9ec88
-
SHA512
d5cc947fafb2f310f3c939fbeecd31ff01608355a75d307cac4b3f8cc104db139e1928f463bba8c939b86de2ee01cf7358478526d27674d2cb0b569f285b7c35
-
SSDEEP
3072:ivm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:E1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6572dffa8610730dbb03dcd705a2d0cdd694abf6ac11bac08f76be7aa9d9ec88N.exe"C:\Users\Admin\AppData\Local\Temp\6572dffa8610730dbb03dcd705a2d0cdd694abf6ac11bac08f76be7aa9d9ec88N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5dc1345b718ae428f3a4c4bef4a18d5f4
SHA1ab7198db0be8f35473e1b1164346312c43f361b7
SHA2569c321e84d6aed4a0d9ab9737d408b7b342b29b6094bb5d77c22031fdf65b7dbd
SHA512034d7afd6e63b841d25366d2f4042bda682da68f6a2c7107c36ce6a5fc1f0b6f4c35ef142fbc68a3f908e63543af6389d1839a692907dbb570791bda7ed47675
-
Filesize
100KB
MD5472d9ced4bc5855253b0193ae98180c3
SHA1e0371627ac13c15e06cc77ec453bf60f3d824081
SHA256345bde81ee8d93bfe618803c0e47c848a9405da2bd01d554c53dd53d5e0e24cc
SHA512e99f2b2d32a800676d26951b8b739992f58120ad969df09f8846d4dc96d90cbe42fa5b6fe2718678762c5a927d2e00165b9bea0fa6795c6cc8dc2e12ba17a32d
-
Filesize
100KB
MD51078387ac37d4ec89fb18e2adefe0ef6
SHA143cbd2b99e1c595491c56c0a3e49fe452a548712
SHA256d0753e99c854cb94192cf22d7c9e49c6015d42919c7f9797514260ebe5be1aaf
SHA512d3240a20192358381b8a8334d2bb30035d13910de2656040f3668fc53fc6a8747652ee77e47fcd6df4c9a9a68f111984ecd7a7bf3cb6a35afa3c5bee5733b8d7
-
Filesize
61KB
MD51a1105355e2661a65632df48a63e36f2
SHA1753d224bf59cb82786cde9c0ff8d1d2c62d65576
SHA256f71e985f3a6ddbfdec149fe5b33141cd83e39e25385d9c57ca0a1b7dfd384792
SHA51260605ba463fed835eced29da47f9d591d510fa1c56abfff7e4ca45aa3387cbd160b725d3094a918cdb9e8195a8f024d1f28fc3125a47b2b341b261d6d231238a
-
Filesize
218KB
MD5efda70e386032e16ff706168cb0f7d4e
SHA128e372c0cda308e3cd99beb74d0d51027a7c2e15
SHA2564d0d02d5d757fc9c4915b33c72879cb05a7df3ce53e8c975e7598e1c1deb0f09
SHA512a4faee93db3a787f1a72117e53a1b04718c609eece789a4628228eb9b6d74174ad1cdce05600ff3a09d9dcebe3da8c13f37a9611a7077f90fe2ba07569872a9a
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB