Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-01-2025 04:34
General
-
Target
a13f992a5576ecc3bb5c2f4d161a3350b5a3350b6c866657b608bb0f001daaca.exe
-
Size
355KB
-
MD5
76a55d2612514810167f02001e26ef1f
-
SHA1
d3cf25f38f74f4ccc9a2123444648c02e1e7c991
-
SHA256
a13f992a5576ecc3bb5c2f4d161a3350b5a3350b6c866657b608bb0f001daaca
-
SHA512
100661bd25507ee78eca7db75b9b9006e4727d211d1c20348186216e32f24a13bf436a98a3fc6883c53820febca61e20d4d33c07f98726652cca1f69b6da8831
-
SSDEEP
6144:f3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:cmWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a13f992a5576ecc3bb5c2f4d161a3350b5a3350b6c866657b608bb0f001daaca.exe"C:\Users\Admin\AppData\Local\Temp\a13f992a5576ecc3bb5c2f4d161a3350b5a3350b6c866657b608bb0f001daaca.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5e2594293efae3bd8ec11f68c133bade6
SHA1d926d345d2f78f098e7d41c4ccb9273fecd715ff
SHA256f1d7af893aa8d7784c76a81ccaa311e3941f7bc41b20bd4ce315523e69a7e989
SHA51246470776285973952d8cd319be2f7adb717c085c43b8091b49a802a8a52014ddc0603a936b05a2553f45e39971fb948679e04a74b494014ffb1756e3bd1f85f0
-
Filesize
61KB
MD53495e9cdc27d23ef2c0af22e989a835c
SHA1425603fa5cc03e0b8bca892b7731656831e8a00c
SHA256d05d99cfb4d5eb6cc196ad9c9a97056abadf3e392248a5e115357a203c78e5d0
SHA5125c9ad7bab5941098391895d478f61ef1d6cdbf71b9d38b6204838998d05da07424200dce5f2c4d559e7b9137dfa4e2fe7fc951f72fffe779cbca5ccc17ee7630
-
Filesize
42KB
MD5d936d5bcd49944314da374aab4a2d157
SHA1b33ae055bcf47738a74bd1f5bb82130c2a94cef3
SHA25691114053f7218965a9145fd211f368db90e93f2f443fdb629d18dcd61a526ae3
SHA5123842d24a6be29242736ed481f1be562a46f0701fa850df20cb699f361411939f4688222d79781eba279e274b180060300d0f3f0571481f1e8131f2140a53518a
-
Filesize
42KB
MD5c5f2685169a191bb87df03e1e620d028
SHA130e382acc28d57e2972daa0e25c97df6bdf7a32a
SHA256f20f7ed4e65198d30b384e480c1c9347b257ab63c9bb27e81dbcb160d0954eea
SHA512e138a0d342e9f03bebdc532fdb2fdd61a4e40d818917ebbb6fccdc90d1c52d7a1311c11de14af6e24a0d9e2d93df84d27aebc64d50bf708fda104fb236d90c29
-
Filesize
61KB
MD5bafa5f6bb36cea0081cf6fc4d64c0b03
SHA1acaba5785f6378fe71c965006361844e3df91e5d
SHA2569437a298cdec0a6a37106958d6f79412632b17a873a7dc29454cc93e37a076ea
SHA512ec904608927d837bd847ad90d95f16e5b374e0a29a8ff54553f76a8d4e8d30bf57dfd78922187fb1d4fb03e0196c60cd44facce68d3711d382bd3492160f3d1a
-
Filesize
355KB
MD5fcb74a4c6fc83829dbc491f14ec2415a
SHA19b237d406b9796e8e5dd7daaa45d24d628a1f545
SHA25618318829d642d530ce49a5d86016560a2f4fee6db7ed328aaf72b38581c01e5f
SHA51268d5d6c2dc4013f13ad3cf9c8478cd6fc95ee5204c3fad434d55c6748ca42f6ce18b11cce2e7fe7b9dac10ca8d839b29c8ad48496521108cba1ce49c8feb59af
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB