Analysis
-
max time kernel
111s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-01-2025 16:58
General
-
Target
16bebc908b8eac78209ca272f6d91893a2971f6d601411ab342ceef7ebe128e1N.exe
-
Size
208KB
-
MD5
d543cb1812c9bc4248d651ff04dc0840
-
SHA1
4a2c525d6ccf2c7037b6f107668d1a61b0589356
-
SHA256
16bebc908b8eac78209ca272f6d91893a2971f6d601411ab342ceef7ebe128e1
-
SHA512
df9719027b658b2a2db231e06a68a58ed1af775d7b5f7cb1fac137d8d5d588c0e76a6705669cf2c7abe2e4025f14c22acbd1c42cfd98b6e7a72cf73cac248eac
-
SSDEEP
6144:ta1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:tbapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\16bebc908b8eac78209ca272f6d91893a2971f6d601411ab342ceef7ebe128e1N.exe"C:\Users\Admin\AppData\Local\Temp\16bebc908b8eac78209ca272f6d91893a2971f6d601411ab342ceef7ebe128e1N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD53d5302869098432860fdd011fc769303
SHA1facb9d4a1fe06c1d55bc443e3dc1061ae5b11e2a
SHA256aa485d6a8d20af83351a8bef7bb2a2cc2b6b3a47f6370c2154cd719049145a82
SHA512374676792f8059bcf52fdd14042056875f7db4dabbc6bb42694ece8b6d3327c0c33e43140fae75bf4c0c8e86bfd3909088ec139c3aede64c5f535e638162c03c
-
Filesize
42KB
MD54ee545620929feda78091fd3c8f34757
SHA1ebc08aadc195fa71bbb5922ed9174ab3a406fbd4
SHA256a7f8c04ea4a280d3ab347edb3d93b0bbf7b20b8676a4cbbfbecfb9a155b93cb1
SHA5127119b101108bfbd5b23215b9cb6cf6bde233a9b15aa439811e1ef666847b958867e16b8d45c5a25550cf5f34220ea8bc4f6050d056647c1b009a9408c06b694f
-
Filesize
208KB
MD5b351e1348530814026ae9a0e5e618247
SHA14754841a7933eaf8bc2ca49de367ebd2fed334e7
SHA2561a4528227124c620431cfa8a439b8e942ac920d33fa287fd07a04c98e22c209f
SHA512ca710ac6f17bb7bb6710409c562c738d8b41737a534f1b247a5d97835f7195982f5f0e677ec9bb11013b18fe13d49ec2fcf0afb5a9565ce77ec313c22b33d317
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB