Analysis

  • max time kernel
    111s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2025, 12:32

General

  • Target

    b061057a5b08703a0186859551c05085d1986dc7afa28a63f071b86406fed3c7.exe

  • Size

    208KB

  • MD5

    943bf47be85fde14a55b09a8a4509e2f

  • SHA1

    f8c14d4c20b75730b0147309fa86a5470b31b58a

  • SHA256

    b061057a5b08703a0186859551c05085d1986dc7afa28a63f071b86406fed3c7

  • SHA512

    27f6c36fa9ef942350ab01421025b75b1fb85f9c1827f5829a893ab2b367d56ad8ec0218e4fd74fad684e48edfa0581caccd9682ba267f7a7863b0677b64a934

  • SSDEEP

    6144:ta1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkA:tbapK0JCmRcU9vVokf5

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b061057a5b08703a0186859551c05085d1986dc7afa28a63f071b86406fed3c7.exe
    "C:\Users\Admin\AppData\Local\Temp\b061057a5b08703a0186859551c05085d1986dc7afa28a63f071b86406fed3c7.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2452
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2216

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\40.tmp

    Filesize

    61KB

    MD5

    9c46a44d6420bd7da8701cf19d9a56ec

    SHA1

    c3e33a2efe1ac76a2c38e9547c55ad139baae091

    SHA256

    2db9eb9a22b90162bc1948d09ffe45f90c6bd385e3ad6bec57ba8c1c070c6c54

    SHA512

    a1fcdc8b65c444ff421ab7afe54d1dba188dde07fe64cb0288427c64e865267550c9ee7383e317d86e04a8572a53db8a79f687fac4e0f962321f75c00614e0c5

  • C:\Users\Admin\AppData\Local\Temp\607F.tmp

    Filesize

    593B

    MD5

    3b03d93d3487806337b5c6443ce7a62d

    SHA1

    93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

    SHA256

    7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

    SHA512

    770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

  • C:\Users\Admin\AppData\Local\Temp\607F.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\806D.tmp

    Filesize

    24KB

    MD5

    a653a3860e5653d7f7b738aba0d3e69a

    SHA1

    171b3c34a75747b6fd6fef07b22c0a2f27dc4298

    SHA256

    e1812b2e0d54875e52bf7a6ab23aaa2a5e7a60b98fbea49f8afd66c306f37796

    SHA512

    a939787a618e2f25827027a8891ecbbbb3a04d4d63c7fb311b4b601277aa1304bd467699125cf9a8c80f274ca09ce81d3f57499ee6a42caa1a436098fe6f6740

  • C:\Windows\apppatch\svchost.exe

    Filesize

    208KB

    MD5

    29d28134423cc7c1a7f92bb13226cdd3

    SHA1

    f7816f3ac9d666deb083edf53865d5c5d914df4c

    SHA256

    d92bb9f0d11fb64e31aa5b4b3f987cacc4f91b19be6cfc766b3455c510df9695

    SHA512

    751aa645e9ce69bec24fdd44f8da74947bdae2c7f67e58549ce45e907f0a732b7a06cfcb5f3430f084da384f544cb775a8fbbbedb240d811df22e78a014cc828

  • memory/2216-51-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-49-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-18-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-22-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-20-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-23-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-67-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-79-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-78-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-77-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-76-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-75-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-74-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-73-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-72-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-71-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-70-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-69-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-68-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-66-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-65-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-64-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-14-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/2216-63-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-61-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-60-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-58-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-57-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-55-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-54-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-52-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-17-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/2216-50-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-46-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-15-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/2216-47-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-48-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-44-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-43-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-41-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-40-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-38-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-35-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-34-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-32-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-31-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-30-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-29-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-28-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-27-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-25-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-62-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-59-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-56-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-53-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-45-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-42-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-39-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-37-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-36-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-33-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-26-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-24-0x0000000002BB0000-0x0000000002C66000-memory.dmp

    Filesize

    728KB

  • memory/2216-16-0x0000000002A00000-0x0000000002AA8000-memory.dmp

    Filesize

    672KB

  • memory/2452-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2452-0-0x0000000000620000-0x0000000000623000-memory.dmp

    Filesize

    12KB

  • memory/2452-11-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/2452-13-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2452-12-0x0000000000620000-0x0000000000623000-memory.dmp

    Filesize

    12KB