Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-01-2025 21:30
General
-
Target
25dcb56615ed28457721d23dd093b3e481ad7fe87b0a8d7719d600d933eb6d84.exe
-
Size
212KB
-
MD5
e3214e660e2c015f50d0a17b315253df
-
SHA1
7518a2518629a0ac151a11c5dc6d6c1f5ea7548c
-
SHA256
25dcb56615ed28457721d23dd093b3e481ad7fe87b0a8d7719d600d933eb6d84
-
SHA512
f24f23ca7cd891545c4f668560c262cc840158f8761cb44e269e34f1dd677e0b7f9c4840a087bd1e95e4bcbd6f1ff552d8792ae83810d750f07497655a9f8a9f
-
SSDEEP
6144:Yob34ERMS/H7YAVsobrVn5G4E3Hi96mbQzJWFO8Omw4GZ:HboEj/8ASWM4Ki96/zqIKGZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25dcb56615ed28457721d23dd093b3e481ad7fe87b0a8d7719d600d933eb6d84.exe"C:\Users\Admin\AppData\Local\Temp\25dcb56615ed28457721d23dd093b3e481ad7fe87b0a8d7719d600d933eb6d84.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD51f062d0158da3286017bf17a9c734545
SHA1f34af98018f6f0319fc5e09d46680208d89ebbea
SHA2567e5c2c37c7b6cf1eb8c91eda5febe8b58efca7b393aa629cd2be72715c198762
SHA512d86ad27941335f211c46077404140777812a47d6b8d779f94d91e41c0f32425a9bc0914c12c0d2161a74373ca99101301b18be807890de73658bb700b3ca9eb2
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
212KB
MD5c0fd92a3c8efd27d0a85ef9495673f89
SHA14268cfeb138936d1ef9bf2b8656c8f9ed817351f
SHA2564745d741dd2992d9c36f3f5b2894e649e0828e34af79c3f4f166b8b5672f718f
SHA5128ebb782b00af4d5c0d83e5fd46959191cabb2dbccd6c43e3e3bde09b5ec61f55694a708ef516e9ea243fe954d5278ab1f3db3ea4ceb81f5bdf83e89fc2744daf
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB