Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-01-2025 05:24
General
-
Target
952e5fc0d170b186fcf3ddd8fed6d1f9bf82954a8553515ee6c7e8f948347850.exe
-
Size
218KB
-
MD5
a4c708c679a8c3c81161f29194f66033
-
SHA1
b968bba12f2c3113fc3c1e0964647e1446fff20a
-
SHA256
952e5fc0d170b186fcf3ddd8fed6d1f9bf82954a8553515ee6c7e8f948347850
-
SHA512
61709bb0e38bcf3c9adecc9a1aef302879debf05034eb2a2e0769300154a9b9af40b8029ab829d998c84d974020d816dd27e1a2de3f72ca833e29d6837e842bd
-
SSDEEP
3072:gvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:O1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\952e5fc0d170b186fcf3ddd8fed6d1f9bf82954a8553515ee6c7e8f948347850.exe"C:\Users\Admin\AppData\Local\Temp\952e5fc0d170b186fcf3ddd8fed6d1f9bf82954a8553515ee6c7e8f948347850.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
2KB
MD575f1c42e375001dfb2eb4f3c0fa8c517
SHA16544192e0dbb0126440237d09b783d2b3e5a46a2
SHA2568a7b746a0060f15530c7f7898c1094778e455cc2d32bcee06a61c9c8d569faca
SHA5121abe15cc895cf08bb9090fec85206c685087637585e5ab1b69ee1bcd62ecf82a7dd7e7ade88bce58766767ecc57b0b2984f907e68f85f36278378fe43363f5d6
-
Filesize
61KB
MD5c3d1b83033d78cf625fdc118bc235420
SHA12ade29fdab57e702442a2c5270f86b896ffb0561
SHA256a872045713972067e860738c65d96911e3fd04c8e71925bb71e2ed2f3d681c12
SHA512ccd98a09a6d9555d3dc9cd9507a2cd7ee4b54f2a568d200669b1a13bdcb690a3897d419db8c0b1867a5dc620d988ccb35746501b02e21b7dc415663523df64a6
-
Filesize
24KB
MD5f35a5b30f1f60444cff8d9873e5566d6
SHA15617060cc1e8d7cd28e1b55a70f2f0aef1a41693
SHA2564ec3af0a6c17b526f4733cdd8ce44f60484d23bd10622d98118073cd2d09191e
SHA512831ba06d732291feff6f7f8e6873c159a5acb2da557ad229ad45f7637fa554ce40db364baa038f2b681b0c6886bf9d2f6fcf4c1ff5c519d2a023e6be3ae910b7
-
Filesize
218KB
MD5fcc5323abd989213d8f073e1edcf3ce7
SHA1095a1a52d013051add29369893449d41ad1877fd
SHA256519135426211090a6b214bd3d2f0bfa8d34ede9dcd87f65a1027203d255a2302
SHA512d76c688728e674f6d31ce8ecb3293e57800e20db66becf4d0fd74b3ec3f55166bc7a3b9e6a7d544cfe50eede360fb10acddfab05d97f6f4563b03c0e8b307ef3
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB