Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-01-2025 02:58
General
-
Target
5ebbd10e8e84c4306a3601d57ae66cc25e9cb76187c3bae6cfdb156ee0bd1371.exe
-
Size
217KB
-
MD5
f7d653b79de92d678be19db1f9f4c44f
-
SHA1
c26b6d5e82525bc9d540b43b7b91b2bccdb46bae
-
SHA256
5ebbd10e8e84c4306a3601d57ae66cc25e9cb76187c3bae6cfdb156ee0bd1371
-
SHA512
c14b1ccb804b9514ce88147f22fa420d32135eb14e7f60bc0186ff08274908193c982c41a73b3992aeb9317f236d9d31ded16bbb5f42db672f5825e44053f39d
-
SSDEEP
6144:4rRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:KsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ebbd10e8e84c4306a3601d57ae66cc25e9cb76187c3bae6cfdb156ee0bd1371.exe"C:\Users\Admin\AppData\Local\Temp\5ebbd10e8e84c4306a3601d57ae66cc25e9cb76187c3bae6cfdb156ee0bd1371.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5eff7e70394e16e0c758feb9942a0d26d
SHA1a503d0d152022bdd8ca0be513b48c652a2e19b99
SHA2569b714ef961b58f138b35f5e73cd65f04e08ccaf46fb3e63609f76c3b5605de4d
SHA51204369119f083d15e72ee57280457931aea966ffba5036a10ee5626e3eae0974ad7fcc78e2fa63d75ad34174a81ef1c0e1384965612e7482a640f92167f0a461c
-
Filesize
42KB
MD5995ef4464bf96d1ac74dad56e66cf67e
SHA1e831ea2eff1ac7c13a2a47c87a93d6fe807f1c9d
SHA25625f9767456747eaf2751334a5651260cf7eb4677458468e43e59ba58e13b88f8
SHA512f66e5e70446efb49294e3ea660e22e538f303abd18335482e040b9f3a3ed377633d6ebee859c502228564dbef39ea07b7013f49d2e9e0d836e5d81f06b32f7e0
-
Filesize
61KB
MD56ce9600ecb39d0cacae3ac592bf4e811
SHA19ad382e34702f1e9fba1f7258b4f4e74d28f9574
SHA25602218d2b22f612b4a7edda2caca22f14bb05c8579c1daea2af8c4ba13eaf3698
SHA5125bb2026154e60db1d321d0f6ef60bb3f51191e6a7a9aa8ef007405edfd6dab4282f9786a34aaa1f4f50f78e0ad03ab2332ef13d163acb0cdb5465113d86f75e9
-
Filesize
217KB
MD59f3b11cfe9f946f7d116087768dcec0e
SHA1cc8bd0371e293d070458a33baa90808f2b5ffb1a
SHA2560e8ed03dfcc41c824fd5ba7bb5e2aecbdd3841406efa84e55cfb49d661c9c0c9
SHA51263201299f73d92126849e29375457bd2044bdd6d9555511fd1e4673d3645ae2800d48b08f39494d9182c09ea153162b5691c99c3029d54143927436bf841de05
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB