Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-01-2025 04:40
General
-
Target
95491e894b8d5af827811334ea9dc09754bcb1403ece7eb665b08b65a065bb44.exe
-
Size
355KB
-
MD5
4b41e8ed252483b8ca474332a0f09bc1
-
SHA1
ba76a993e3426829826bf163d67adbc92e9fe254
-
SHA256
95491e894b8d5af827811334ea9dc09754bcb1403ece7eb665b08b65a065bb44
-
SHA512
6e0b2bd62d76a18272c92d9a1621c12fa1cf17f6e9c6ec8cb45c0852287c7946ec7021b69a0e2dc96ab58da6d636282eeb499031474a5fbe9c9d63f149718f4a
-
SSDEEP
6144:L3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:omWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95491e894b8d5af827811334ea9dc09754bcb1403ece7eb665b08b65a065bb44.exe"C:\Users\Admin\AppData\Local\Temp\95491e894b8d5af827811334ea9dc09754bcb1403ece7eb665b08b65a065bb44.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5f6281c3e34087651ed137ac62fb3babb
SHA1620130205de00a0692ac528c1061fdc9fe827e01
SHA2567e1d60da28bb483f221d4b6ce0be21a0b2d4a222a5a688b58533037dddbf3dd5
SHA5127e0fd75cf7420b96d9f08a77b436d6dbb6dd88ed11a8d8bfbf8bdd3de96404bf1217010cb8d2083a4bcd4bf4f46c50d5709fa15685851bcefd0dddbebebe5571
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
61KB
MD55b8292f2b1dd229c8f0f4383a5663a09
SHA131407eea856e39eeefe81371770acbbf39f3c451
SHA256af4a3df5f8c33a4d8e772b8fbe23798b0d235b6cd91a5087efd8d58e68e3845b
SHA5127d8658bc8669503c04e7d45aa498bf6d8c4d39e6cc4f21aad3d9aa9b7184143ce922fbf4166fe173acc34e7594d34277723ae3dcc3391c15e12dcdf51f2a8b0a
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
100KB
MD568d54671529f34960866adab79047bd4
SHA1c8566d1f1a0123ef57596df68caf4bcd112a42c3
SHA256977e87910db7b7bead96125d8c584615bd3380ba007eb6ab204f089da1034faa
SHA5121250f29de55334b9949c6fffbe8706d08a6e660a0bfa17801c3726f023a628ae15fead73493a4408137c6fbb20e28fa4bce1779f8659c80b05239c33689d2af9
-
Filesize
61KB
MD55c9eef5170f051278bf18ca760affb99
SHA152ad00132bd3fc23971c36a9ff2d2b5ae0e1341b
SHA2566332c4ac6d5f106eb61c5dd67bdddfd41ff4acdef3935c68461c2b7c412c51f9
SHA512232fe788247c8776908a7180783de56d36ff7b53ecc3d39bee193ad02908d7a4c1d4a264226c9bb7cd1cc08969a9d52c244eb359052846078352f4040cce4530
-
Filesize
355KB
MD5984c7913096b8f83a011999ab5e9591e
SHA1b51157881026f8453a8cee72b8b1e770141e4398
SHA2561ec5e2bb28839c157973a21b5b9b6d06c20ef697e2ba667bfbaed266b4283dc6
SHA5120179729d7f745e6e19dc00e736360c59b665ecfc934a6e04d91d990c617e365d90edabf7846376d1c2e9229a75408886ff3ff5cd11b04b531d11bae81edd1166
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB