Analysis
-
max time kernel
108s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-01-2025 10:17
General
-
Target
c72cd4a7d8662c277273a9fde016f1645cec9cafe80dee0d4cfb4d2733899fe4.exe
-
Size
686KB
-
MD5
f1871bb58c3160ddbebc73ad0b8a92b9
-
SHA1
d18f99fba57008671ef4e5d41b0ab40917f03e34
-
SHA256
c72cd4a7d8662c277273a9fde016f1645cec9cafe80dee0d4cfb4d2733899fe4
-
SHA512
9f988f408a42565d97cb1288805805117c335bd614e30f5d1d896e9fd93eecc2e45ea693040436ccaf4ebdc32763db9a2e69e2e7733368826225a232f0f9627a
-
SSDEEP
12288:hmWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgpV:hmUNJyJqb1FcMap2ATT5itjCYZ3DSoV
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c72cd4a7d8662c277273a9fde016f1645cec9cafe80dee0d4cfb4d2733899fe4.exe"C:\Users\Admin\AppData\Local\Temp\c72cd4a7d8662c277273a9fde016f1645cec9cafe80dee0d4cfb4d2733899fe4.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD58f64b8a9d0b548ef3fc43aaaddf5822a
SHA1289844498f2cbb57bab175013bb0deed28b3da5f
SHA2569f1a88b3f480b1025e3a2ae4d271d1bae32f51fe67ddabd225175c8b73a02988
SHA5122ee846765597a7a9747c78b8d73b2d9131db8a7d261f5998bd5a24ba1a4b022114ca3895a8c91d9385998ac6d9463a8cb0143927d5258658e75d65aaad91d240
-
Filesize
686KB
MD539b48cadc4ab177f094bb9f3c2506cd5
SHA17454d696ad6cf5bcf3b110be662dea1863389782
SHA256a0372ba05939f71da36ea2c0709404ab4467339e7b85c5fb9368938a0b2b5832
SHA51233f21154389f2f4aaa321c9ac91ace7c7f2a16216de8023fa27d1ea6e238a4e79959072c266f862d3f9b3d2c6df8583bcd693aed571d4bad53a143578d2976b3
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB