Analysis
-
max time kernel
111s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-01-2025 01:26
General
-
Target
60ad20b98f57d569c6b0406e2f9a562a97b570f685b389589162bc95dc3a9686.exe
-
Size
208KB
-
MD5
cc19ef7471a39b855b169f16d0491186
-
SHA1
48fc84aea094043025699842af827fffca6d3033
-
SHA256
60ad20b98f57d569c6b0406e2f9a562a97b570f685b389589162bc95dc3a9686
-
SHA512
1442cba0e8622a8dd10e169568fceff1db203caa22efb390f5f70e8aa5ef74e3a5df0ad4542cb184534e1dbe906bed930e4e9929dead2aa9be4401e1a95edfe9
-
SSDEEP
6144:kYa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkQ:xbapK0JCmRcU9vVokfb
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\60ad20b98f57d569c6b0406e2f9a562a97b570f685b389589162bc95dc3a9686.exe"C:\Users\Admin\AppData\Local\Temp\60ad20b98f57d569c6b0406e2f9a562a97b570f685b389589162bc95dc3a9686.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5c2b3924ccb4ad2aa51613d5b45679399
SHA129e177c8a6585234171d8ae640e014e3672b1b6a
SHA256b00e469367eb3a3ee55b408113b845e54bcadd78c14a69da9e218ebc6298bcc8
SHA512a615bd20fe21c75ec5d3fe686e135428e56352f2ad26d3c5c04beb71361df01f605e67a2a497a34b37c2f9344d8d89a1c56338ae34efe496f41ee4909825db9f
-
Filesize
42KB
MD5b46de83d340a02679f798088c2dacd8e
SHA1bc9fe3abd70e72c37141235585e3ea30f267368f
SHA2560583a995803772f6ab28df85e8dda05eb559ce8a16a217c56a31d65ff85e7beb
SHA512f414480e8671c7ead5786b6c96c93ad2554ed69eff6c88137c8fde429869b43e0edbd73409166627e0755399080e7d1830ed653d6ea89befaa5e6e4180541f76
-
Filesize
61KB
MD5d4c58a7c3183970d5ef38a12012c74a9
SHA110dc56eb5842e0476c4b0fb4bf4afcb7424124cd
SHA2568f8e707991f4651d12909d85af74bb5d282a96009bb0457a1a54bb90d3bd3c6c
SHA51288e72fe2c354ee2467dcf3f5d3647129ba0d95f9decb604c20802bb94b1540dab07cdab44913c7a66b207b960da8dab4b3ef1b52c63d0dbaf3e041ac4b9c672a
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
208KB
MD5204cceb3f055f7fc32f9ef3a59377caa
SHA1d2a3060010cae2b9b320f82f348e52f324273164
SHA256491d95176a63e567986b4377e317ba37a08f72ee4d97a19f4ba46029e575ed54
SHA51203e9bc8322d964ada6a18d246c3fa8c226ce194ffd2357481d6d37b49dbcf0a8eb7e97624aafdb0e4e9defe74fa3a98b349f90d2c9ff768300f9cac0fbc63f36
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB