Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 15:10
General
-
Target
7434f290945801f3fd369575e73eefb7565663e3f2b93ba98bc0f0b9fe414f95N.exe
-
Size
218KB
-
MD5
54388b35c852894bd1a045922d617940
-
SHA1
6770195c78306c0a1d958aa4bd90c9a61b33e27e
-
SHA256
7434f290945801f3fd369575e73eefb7565663e3f2b93ba98bc0f0b9fe414f95
-
SHA512
0fa438c06929d7bea8602f0b42357b7e6ee79bd28c3ea86fdf38b563d15ab8931b6123fbf45ce9e0e3a395cefb7da9bea804932999bf58d29f5d47d207e5ce04
-
SSDEEP
6144:xEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:xEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7434f290945801f3fd369575e73eefb7565663e3f2b93ba98bc0f0b9fe414f95N.exe"C:\Users\Admin\AppData\Local\Temp\7434f290945801f3fd369575e73eefb7565663e3f2b93ba98bc0f0b9fe414f95N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD50d7b01db354207ffb7fce8b491362d4b
SHA13f893b1d85f53b91b21601da5cad889296590534
SHA256ba458caae6d8f54cb58264fa583d6586432e8f0354a9367888d5ea60044c78ea
SHA5120c592727d20f9dbd1924c93c2acf38f1e308a86678a9a34b1d846119e8cb521424184a024a80181afaf2daea35bdfd00b39bc2e498fd7b79babec03635cb1c95
-
Filesize
218KB
MD567322a5b576c1ad9df69888ad046d450
SHA144e73785333d541496bf8f8072cd97439b263678
SHA256d6fd2a6382760b01b15b2b7d59d6a91ecb6e1bcacd7c1ae4585642f39f1243fd
SHA512aa4a4202dd2663f976bf41659583714965b93a247e72e1419c566bf2405c1d6ab35b8e9d320ccf8e49aa3138abb3403caec40bd60392779a42b4ce5f9af6b9e6
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB