Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-01-2025 10:58
General
-
Target
481329b3fcf654dc9153e8148c76742d010e10204ad051e3544891085a9fdf31N.exe
-
Size
355KB
-
MD5
c1d0062bd4636e79d499f9a867eba560
-
SHA1
294706c42ae8eed59bb17f9f7b4e3b2d47759aa0
-
SHA256
481329b3fcf654dc9153e8148c76742d010e10204ad051e3544891085a9fdf31
-
SHA512
6048ee2829a795f9cb9838cd0c226950dd8352fb6e19d09d4d749a791c2224a5249a8b6776bd5bf7d81c8c43c8bb82f8ea69638a9045abe1f687b24651d65092
-
SSDEEP
6144:s3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:nmWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\481329b3fcf654dc9153e8148c76742d010e10204ad051e3544891085a9fdf31N.exe"C:\Users\Admin\AppData\Local\Temp\481329b3fcf654dc9153e8148c76742d010e10204ad051e3544891085a9fdf31N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD57d008b7aa3e74488cd69c667fe9a994c
SHA1420e34c174be116fa1b017d347d9e1f662b51f68
SHA256346e2b2f47953a9952b3102b31e6a492f7e46686b20e65e9c04ec1674dc9c0f8
SHA512852f2b77f00cbf94b46b3a9ab7f49648a578a80349ccb4aed7a7777c80963444c67c590c40980987a167936eb0c0d500ff2876706d96b4dac39a18abfdf9b2ff
-
Filesize
355KB
MD54b0293c62d9d6595f45402a9589743ac
SHA1578e45b76456b3d3d69924cabd2c1a6ed603ffbd
SHA25650a52c8ec4c265995540e0df2b2882c53fcad06aa374945fa502555145d6328f
SHA512c52cf9e6997c9c958b1ab012833dfac0ef3827679857922fe47f78e4e92860652143490c8275587c99caf9db5efe840c92665b8724285c0a1d79717a005d487a
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB