Analysis
-
max time kernel
111s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 07:34
General
-
Target
8cb2af5df1be8cf57e7152c3dff8e41975c85170d6098f05a13090003d41cc65N.exe
-
Size
218KB
-
MD5
65bad37574feccb1755b4b635e34b9e0
-
SHA1
9e6634313834519a051d1f117e488b106304d4d4
-
SHA256
8cb2af5df1be8cf57e7152c3dff8e41975c85170d6098f05a13090003d41cc65
-
SHA512
02646fa43f638ded4338af0b7601b215400dee6e85abcbebb0dc68457d00aa67720444342fb45400bf6fb2b3ed3cc4667028048a228e6ac14fcb2465cc328067
-
SSDEEP
3072:rvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:z1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cb2af5df1be8cf57e7152c3dff8e41975c85170d6098f05a13090003d41cc65N.exe"C:\Users\Admin\AppData\Local\Temp\8cb2af5df1be8cf57e7152c3dff8e41975c85170d6098f05a13090003d41cc65N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
42KB
MD5041a336eecbffb00e4c3e0034caaf638
SHA1e10f0ac32d56de2231c820a124f0a131890e2dcb
SHA2568ea3a08e42a403fdbc45c353fc75e5252ea59180d4693b3db2a3de6b19ed9837
SHA5124b3bc441b709322876f34bdef4a01ba645fbb850751885c2ed26b05eeed2e6c298564f96eea23e5e445a3ce679d9499bedda53f6f2e560c1ae599cc9abf8c6ea
-
Filesize
42KB
MD59c9c8e6ded77d77ba98a27a89039dc98
SHA1db249945e10ef335f37f17ec7702ba58a49e54b4
SHA256759498faae19c40b260af2dd4ac8e56de1ab5f6a7f3d392c098e84d49bec2a0d
SHA5129f4c168c91c6a53053e57b36e5781c964f42de7b2550b0a328f5f30d9522e0176612f018f1853c03fa2a5f4007f82b7acad023973a56ff3f43cc9aae29e560ce
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD531caffae6962c3791e4aea3a4cf24ebb
SHA129e5e84fdd38af6a9841fec541344a3442dd6058
SHA256a6b4d7ac9f8b30146143a7f2897b210d3ff368b78297a6a61ee0a25ace67293f
SHA5122a89f666fc3c8773b1fa5c81ab52d16f406e2bb5a1eff9e370bc911306481f391717343a725ffd387abfab19736c1d92b0f8b78c07708aa67799c820ddd46d70
-
Filesize
61KB
MD56f9e0bff95f88b59d3609f699839371f
SHA19b46d296aeff3cb2318c6a8b48ad65dc5e60004e
SHA25636cee4672c30ffb36ee63e368c92bebb2e63f4fcafa2de01967a8c7d0b0d450b
SHA512d5e0041f0cbdf5af53e3971a11c36dd26faaf6920851b4ddb7ad4a30cf9f68e19464bfa40debf7470c9c57da4319e5693c686862a3059a76c10bc08da13257e4
-
Filesize
218KB
MD5a74cb99bc17fbde2e4a952a60acad57e
SHA1693137bdd411ac7bb21dd851a08e3ed3bc78bd6b
SHA2562dcaefc61b77593947c3628c91880f14da874089a38d6eb8a44592c33d42c44b
SHA512ef86de93f82a04a9a5ce8232454dd956be9821cc2c5b0489f3f15ef289f5d2bc709140c8fcee3eea9671a5c90e441ee28d17d6ed3324f9646212635b180da7cc
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB