Analysis
-
max time kernel
109s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-01-2025 14:55
General
-
Target
f7b78f7ccfd2543c10ddad54317082b90e93daa671415d013cd3d4e9a96e034a.exe
-
Size
355KB
-
MD5
b3b1a2b21597dc7c539ed2bfcadbc0d0
-
SHA1
5bc2b693747e858c05ce60ff0641056cf5a5848d
-
SHA256
f7b78f7ccfd2543c10ddad54317082b90e93daa671415d013cd3d4e9a96e034a
-
SHA512
0ca9217352f7a825f228a7ceeec51ef9a25f8dbdba0da46563add09225ef2e248bb747562295bd55277600d24c9a99b7bea4193ed0eb8a1bcaf6c43f71fca96d
-
SSDEEP
6144:s3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei2:nmWhND9yJz+b1FcMLmp2ATTSsd2
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7b78f7ccfd2543c10ddad54317082b90e93daa671415d013cd3d4e9a96e034a.exe"C:\Users\Admin\AppData\Local\Temp\f7b78f7ccfd2543c10ddad54317082b90e93daa671415d013cd3d4e9a96e034a.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD507e6c0d1ca345c9f9eac1ba845029c37
SHA1214b237337be45e1ba9f4cf8c233b0b2deec3118
SHA256996a4d4032601d3ff12050d854f4f281a2a97b69c6d62e1e7c13134bd9fd382d
SHA5122c0d10b9649a2d7d55d2b41c105d4a76c322611156a69cce06a01d9be3c6396254685e9f706d1dcbb3354e53dc0dcd8685fe4d9dc5158750216264d3882a79b1
-
Filesize
42KB
MD504f05d673737ff9d56dd27d6456d621c
SHA1546e2a997df1c6bdef3cc5fd01b541a13afdbc23
SHA256ad92e1bff81b5edaef61b6419aea4e0e9f2f697231c5c53300aef4ac06726eae
SHA5128cedcd77f83c3c23a6ecb0068cae7878b612622225aae160ba04095218a9ef3f3bafa28716ccc394e3d5540c8f4ccf6b5d5cac7b816d2aef60638cb6655acb00
-
Filesize
24KB
MD5681e304f9c948c69d53bf7bab211acad
SHA1d630f0c79f6a72e510ef8406d5af245aeb89e83d
SHA256af31a7814c5881e8038adeafcc8f38299532235f8fe326a126b0eb0a2ebdefa3
SHA512607dad659cf787e138aa7d17f70207193c0f87443b2507798fd111502ee670b55859081e9694618415571f888185d690c40dee8d0991bf4aa6dad8f40cb1d159
-
Filesize
355KB
MD5b87b71e2d85184f11ffbc3ffeb17bb9a
SHA1329b8f84feea78bcb598c7de33ebe71299cb08b1
SHA25636a62a8de1ddbdc80fc717caf0631846919f8cb1d7600189d9b3b64349b08b22
SHA5121a753e6629dedc67263c87156bbd33248be1c46121854929714b35083e7444b9ae4ab1e62c88037447ec6009fff5c2618a81dfc22f498e7a165d68024b66bc15
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB