Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 00:51
General
-
Target
67b2050f624634c93a93562c290d53d9ff587cbf085808c55349d98f3b5ae6f0N.exe
-
Size
217KB
-
MD5
fd757a3771b86c4a59042b19b7bf2510
-
SHA1
9d27e047b17c2f198113874af2d5f8cef05aa78e
-
SHA256
67b2050f624634c93a93562c290d53d9ff587cbf085808c55349d98f3b5ae6f0
-
SHA512
a6bcc25323c2eb403bffff2ee613bd750d70fe146ca877a05fa28ad8850029b0eef082ce6d2e9cc2901fdb406563e0a87d5c7c46dd5e6a92460d1298df90f72e
-
SSDEEP
6144:drRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:NsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\67b2050f624634c93a93562c290d53d9ff587cbf085808c55349d98f3b5ae6f0N.exe"C:\Users\Admin\AppData\Local\Temp\67b2050f624634c93a93562c290d53d9ff587cbf085808c55349d98f3b5ae6f0N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5feb205154fc12c18c57e5754bab8a8cf
SHA102b9469433a2e9b34985309a65a4a8515b23ce48
SHA2568748f9f71e9204e3abbdfe8148e10ffdb3ada9610ddcbca4c0158011c4db6307
SHA5128cabf13f6ad922815de86fb4fe7b9aeed3df377909f18b27aaa6025d66641e1dba03f2b75e26a64a262d523ee3dc34d5e7255af6700588f9a64a131451b46151
-
Filesize
42KB
MD56edeb3f742514151887d9a4cd965c5d5
SHA1a4c8e84269bbb0221ae6254f0081e208acfa3b74
SHA256853eb73b5fd29b89e71971a62f746313f295e13e2924fe92034a795571e34bf5
SHA512a259cfc44b8ab7ae6ab231f9696d13cbed3d892e2614af5bd5a77a26ff34a058508244a804bc39f3536a292dcd7a289f4bcce0befbe272bc5d0e8c2fb74531ce
-
Filesize
42KB
MD56efe1df5aaa091d5373bc40c86470436
SHA1f857ab6568c58e6efedf78ea9ae4b3d5df30191c
SHA25669e1ac4cb59819287f7c264e883fcfc16221bd93a4e836dde6a815ba254af34d
SHA51224d14eaaccaeeda3f086dea4f1cc602cfb7732ff5e9501e6669d544582e17f8b9f876708d692316d2e97e686f8ebf38f57c679328fd63446aa155ce93c12f1db
-
Filesize
61KB
MD5ebbd16a8a09136847ba6721ea57f7791
SHA158a5d507f562c274493dcd93718a50dc57c7d106
SHA25619e085306ccb8ac79442310d0a25a5a006a871241dd26fd86d0b7b44098b8830
SHA512c862e5e01aaf1ace9d9e102d3a9a655a3e1260d75bb4b76ee133654af2e2b18f87456e24d177e01be0d8b1a30126ff9892df39ed0dc56f930cf23d597cd045d5
-
Filesize
217KB
MD5e18a47e0c6207cc09ac769999a1e4f73
SHA1e835656679377ab78fcc8cf7dfa1c0fc566f4708
SHA2568fbc246df31b593240797993e6288a9066f957f0d44a7ddd1270917672d55fe5
SHA512d3f8e4fef88420dcca88e69c4a2aae3c157cf63e46e89aaf4431263df2fa563cedc8ea5d105c3ac1e976b5250dc79025059e1c1f185011d0ccc9f8567dbf9490
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB