Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-01-2025 16:28
General
-
Target
a3122701dab9b1b39995f5ee4650f8b8d4d363fd8dac84f3d777ca255fdc1015.exe
-
Size
212KB
-
MD5
a2c2173c7b0957707948947f74193691
-
SHA1
573be8b7ede22285db8c9c763228e7ab26d6e9cd
-
SHA256
a3122701dab9b1b39995f5ee4650f8b8d4d363fd8dac84f3d777ca255fdc1015
-
SHA512
c3fd2a4e5175b2a0af3757909b379ab025951b11c0d4923ec795950939f5895b0f46244976fb8515f20191b4d44e65995b1731c87a9301f6ac9860170ecf0649
-
SSDEEP
6144:yob34ERMS/H7YAVsobrVn5G4E3Hi96mbQzJWFO8Omw4Gp:lboEj/8ASWM4Ki96/zqIKGp
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3122701dab9b1b39995f5ee4650f8b8d4d363fd8dac84f3d777ca255fdc1015.exe"C:\Users\Admin\AppData\Local\Temp\a3122701dab9b1b39995f5ee4650f8b8d4d363fd8dac84f3d777ca255fdc1015.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5ae63f3cbeb5034e6c9e84221f7dfbd3b
SHA15faef3b479314ffa66d27ebb58da3e16d542e006
SHA25653c01a9f74c0e462c4490c6278f5b0dd6f509413b82083b3067fd2d7f4292559
SHA5122f0b62eaca9990ad4fe921abf3eb69f5475d056bd70a9755de71a0a125a97dda127fa471c859cfa17f8c06cc12bfa44c44f0ec713a5ba89bc4ccba05c52752b2
-
Filesize
212KB
MD589350e02ee773a606ab8229e16a2df50
SHA1d6dd61fc64db2003dbf3a915a5ddd181bd63e375
SHA256ed8821a23614d4a576124f52afaced05115bdfd784fcdf755ba38fe87ffc0056
SHA51205917e9b5e723a3f0acc09260085eead4ce03c99e690ab78d70a330c485909600c2158cf5117f9d6173d14503ede4798a2eba281fb0952a158fab775d92f787e
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB