Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-01-2025 23:41
General
-
Target
4e3ccc35555fdb5a65fa808b0a5a674e44ccd4e6da5316f6ba6651814ca3efe0.exe
-
Size
355KB
-
MD5
66e144b221c8460b772c3989d0ccf9bb
-
SHA1
d1597dd0e5f098a51e65570ec183fabee2800071
-
SHA256
4e3ccc35555fdb5a65fa808b0a5a674e44ccd4e6da5316f6ba6651814ca3efe0
-
SHA512
63bb4ca34fd2c5651b60c2fdf2fb4d1946bee4035008a34939c99cbbabf3b27a60a11e7023e1aafde8ab70fb9aaa4f9a2eed8815351736b170481bee491c46f2
-
SSDEEP
6144:i3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eim:dmWhND9yJz+b1FcMLmp2ATTSsdm
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e3ccc35555fdb5a65fa808b0a5a674e44ccd4e6da5316f6ba6651814ca3efe0.exe"C:\Users\Admin\AppData\Local\Temp\4e3ccc35555fdb5a65fa808b0a5a674e44ccd4e6da5316f6ba6651814ca3efe0.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD59a73852b6f35b2fc18695292e703d272
SHA1966c8eea3701a36c001e99a234de01f720a31074
SHA2568671268e136395a35478570008886ad5f43f38eb26eae3bb77a8cc7c61589f3a
SHA51292698834f692822f0c89eb979df95e8fa847e03644f9c29a23259a1b68bb662b7803cb27049d0dfb6f53092b21e5e109ba17d09060cbf1dc6ee29d1c68fe5935
-
Filesize
1KB
MD574985126b830e77cf440aa39eafd9435
SHA114cc86e6176456ce01c09f05b1127e2bb4c1ac81
SHA25643544c097afa23c61d8f08cea4e193acee1609f8765037b02b545ceece6f3e09
SHA512255a97e049398e621230fa4d8367b4cfd1552a18fc7726b9639bafdafdeb2ffdf8a451b7cc22b00c00e7d95f9af566344f00b996eaa38cf4acb7c0ff436b27b4
-
Filesize
61KB
MD5beb0a4b600a3a21d920f2301ff5b4c0b
SHA14cea21c5cd063005b39c513057a758555e96cb43
SHA2561ec49b0aabadd43173b32173950612dee1c7989ee56ee52b573dad2fc9d4827e
SHA51285c5b6aac7117d89931730130799c002262fc5dfb3fb948302f2e9d78b71f874f7afdd8c23e9e44efa96c79365937e939cf09bcc7bef56fe1b567764d4a057f9
-
Filesize
355KB
MD5ee565f7693b0ce5d61344647cb3de615
SHA10404d1c25d082214c7374ec21ac0f2e8c498abbb
SHA256087679147da4b2b89606ba53581734e716a0aaf18fba0e2263c34996225e1aa4
SHA512efff155647357dfec3cdaa6f36491ee9bb884039eaedf356c94290426e0ab7dfa13c2510bce1426a8640eeee48c6a0427bfa69ec5bc7d98146e38df5a6673680
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB