Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-01-2025 04:04
General
-
Target
a004e12a58e0b65e931d6f921a209dae83f2847e0047b92ebe065cfec460f0c6.exe
-
Size
218KB
-
MD5
f986fd1ef2884dac193a2520473abb1b
-
SHA1
1aaefa2e501eea81c2e077217778589f4b231331
-
SHA256
a004e12a58e0b65e931d6f921a209dae83f2847e0047b92ebe065cfec460f0c6
-
SHA512
06dc09fc4e88ca06813bcd09842c49589b648036def6a3328325d0735a3ddd30ff1f1dd5a798d434551dccb3d9fa406eebbc10dff5ccbdfb38f763fef11101ff
-
SSDEEP
6144:+EQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:+EGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a004e12a58e0b65e931d6f921a209dae83f2847e0047b92ebe065cfec460f0c6.exe"C:\Users\Admin\AppData\Local\Temp\a004e12a58e0b65e931d6f921a209dae83f2847e0047b92ebe065cfec460f0c6.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
100KB
MD571e1dddc875938d189749866053bbb44
SHA1aef794dab70848ddf43f8826767c37f4ec996188
SHA256fe32e70cc03c87446f201a24bb3e4eac6d85cae44d1669d49927a5bf99fb06fd
SHA512ea35b91cdec137bdfa044fabc62adae7ed7c7f83c9b5c50a61fb1f8b6cdbed614100f9335e2e621909ff2b9f0a340b214c83a6e9fba930762d210db0ef599b05
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
61KB
MD5c8513bf85d57a18ee3493b2d6a506146
SHA175de9378cc88e0203a7aaf4bada77434b3dd2c63
SHA256fc969e2255861fc91d246b699e4052261bd51afaaa91494636ff915aa57f2772
SHA512b6bd5c038cee7c18bf764532846959d506d0640b3d3438686b374dbf51d982c6c577bd809038f4100a35b5b2affc78a77d1f53f193dcc3d02cb89baf1aed58c5
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD519b1e1cc8da78855d9cd61a429858492
SHA1c031239b326a078f541cb71a99b1ea440db8919e
SHA2560a3bce47bafa181ce76ede7b5a1092d58578dc538cfe32d3c4802d17d9309d84
SHA512673f9e1a6cde47f68c00d85821231a2fcf10b359083a993f5648641db61a69c21cf6b6d84437c11633733c3d7fe612835bd10f3530e1671c47125dc7528343da
-
Filesize
24KB
MD51fff3879548892526e0867d89e922d96
SHA1029517191ebbf1162e91537a011b2a32a6c0326f
SHA256960c2bd1394ce33a910482facb034d841b82039978239f442fcb1feeb23309d4
SHA51200431f4fc14fed3ae3b8baf50d7380cdf94c5cd67663655e61568884b4ee07c001219d44867015ed404364a79becc922b00cdab92b85ae19b3d4f7fd2f495ffd
-
Filesize
42KB
MD52a555c81a1808e5951c03c3ebd705f96
SHA162beaef84739c18b8f19a4cdbaf788f2db44a9c1
SHA256d8972a67bae66ff1d5185d1a52b973be2c8283b78fa1c4e4fc3edfea09370bf9
SHA5123f20d5e51d02de2ec8a7cd606ec6620c8913005b08264ab12096a1ac668ec2e8f37121d6947fee7560559ad3e51b6bc99a7846c618a5d952655a5f1e3efadcc3
-
Filesize
218KB
MD567ed22739e32f230a45f5eb314d0e107
SHA1a018ce07d4370a5315ca263212f30d2809907cba
SHA2565c27515bb3258d5f7158bb12671abc94e3a3fedec03202c32e8df46a536f79b9
SHA5121a9cb2b24142381f93a7ce2757af49fa9bd5d4b6e875f083b27e590c061f563317f36ebf4ea13d1403331cfe82aac0a42f2ebde53d6fca012854677c080b5c5c
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
324KB