Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-01-2025 21:59
General
-
Target
2f5f7fa17cadb76fd5d27e07e5369b0cda3e275c92a20be681cac102ccb524b4.exe
-
Size
218KB
-
MD5
e14685299f395ed7d429180d41e81e13
-
SHA1
3692c9bb4094be1a8c4104219022d88042bacd0a
-
SHA256
2f5f7fa17cadb76fd5d27e07e5369b0cda3e275c92a20be681cac102ccb524b4
-
SHA512
c2b7f1a96a1932bed3a108109aaf76f921923ec7737106dd8f40c8c92ef8229da41ea8d771490784dd0a0335056a2caf610f9b57c5786c3ff35b91c6d01ec420
-
SSDEEP
3072:Wvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:I1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f5f7fa17cadb76fd5d27e07e5369b0cda3e275c92a20be681cac102ccb524b4.exe"C:\Users\Admin\AppData\Local\Temp\2f5f7fa17cadb76fd5d27e07e5369b0cda3e275c92a20be681cac102ccb524b4.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD588ef10a864602b594f3a17cb639ab7fc
SHA1e26fc8305ccc93120ac07967d9de2d4f4e92b2a8
SHA256dc1f5ea48b7f618ff077f2c13d073c4acf711730dfd03873c35d1fd2ba64c605
SHA5124be45e39407b7b1de1b6b2df80e0eb74a5763193a26336efab72e29f241d632b6a56dcb11a9bd6f6a327bdaa13f0d32875f4c842e1f8d1d6ace4a4a416f33a5a
-
Filesize
42KB
MD5561fdf79505e1df79013bec69f3418e9
SHA18e8e8f8a8db75a2494b82c6afeb5ff8849e23443
SHA25699703097f3c55be94ee6bc586261a6e061057aa854d7f8a02210a0f6cfbee4fc
SHA5128e58662949cc37fc96c1f53d3484d8500e77dfba0e7d24bfa05f1b2d174bee3bfa18a82e0c280a224dd64fe14384e6b2aef9725934ee7c734b56c05a879998bd
-
Filesize
24KB
MD5b5be1f77c09b6f9f1385ef5d6ebe881c
SHA1a4c448c31b00abdf478a903ef32c68a89795d947
SHA256a098eb017bad28b5eaa84b2b60407bc56c9664a839f505659e4433f73f9c707e
SHA512c9e8f13a8a4f1204786533a164a669c6bed3825b109a2ad8750f85ca9e8dd25335e5adfea649430380819d210fcedbad71b8df77bcb5ab7155d0967b54d01d68
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
218KB
MD542f66614876958efec6dd79354143623
SHA1fc95485d28ef0cd3328147a164be83f5b8a38ff7
SHA2561fdf8d77a5dccba0d7498dac5738b3a3731c11a0e54203df411a0090eccbb253
SHA5120449ef02e4dfcd4cf55eba72cd278014b7ca5d851f637be20fb1e5f63800aebf75508dee2fdea2d7f324adec7f6a576ca8f7b57cc72778f1c72be27ea8a94dce
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB