Analysis
-
max time kernel
118s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-01-2025 15:31
General
-
Target
64ef26cd34b424afbcca4006c9a98d23ee95c6705b403ab12a4c1c5f6ff2c9b6N.exe
-
Size
355KB
-
MD5
78fcfbdd4d554b310dccea6da6ea86d0
-
SHA1
22dec65992db1368eca8e08d202c2caecb054654
-
SHA256
64ef26cd34b424afbcca4006c9a98d23ee95c6705b403ab12a4c1c5f6ff2c9b6
-
SHA512
a80d15a25848efca9c80747ab6dfc61098bc03d06c69242c571d58656b24aee75eb06d3e104d4ac525a51b2125eaa0d708048640cae49fa4501bf0a2d1f93741
-
SSDEEP
6144:igEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei:EmWhND9yJz+b1FcMLmp2ATTSsd
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\64ef26cd34b424afbcca4006c9a98d23ee95c6705b403ab12a4c1c5f6ff2c9b6N.exe"C:\Users\Admin\AppData\Local\Temp\64ef26cd34b424afbcca4006c9a98d23ee95c6705b403ab12a4c1c5f6ff2c9b6N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD545b3bbaea5b81a475e8fb4919495c372
SHA1d59d65cb956f07ff62fa5166eeb3c79f389da3fb
SHA2563cb46f46c86c213bdc2b34ff45295b33f97cf6adfb0391fe4dd9022b4a43711b
SHA512701a94081dbf2b9699e7dc2d17078e214188d273b9353810b42d4315cc26accd18fcdd33ed0b804ffd1752a4731438f647bd6c35bda03805d8c3118cc6a2ba11
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5014729b4ccc085703ef0ac5584ed5bca
SHA178f858f664e8b73c55c8893ea285dd894193c6bc
SHA256948db9c3f80348995b4f22692db963b6fdc8d7c0ad85793e40c9badb8fb07a6f
SHA512693e8cc5a5ab111d74aa2f1b66adf2f2ce356eb27647ab6cabc944ba5b490b9138378913be64e3a9117855c5e948a1d76200fa6e90894d9df114e67b8cea733a
-
Filesize
42KB
MD55bbc9c6d75236196b59da45cbca78178
SHA1aa1a5200ec1f35dea6a08543869dccc9473daa23
SHA256a690d8f79c1811254b2e59bb128536bdade823236875a07ce9e059a535349772
SHA5127dd917a8fa6896953ec565fcbfa17aca2e7fc9e85e88d311a8fad402cf1e3bf2ebd8ef08514d8384fe9efa51b8e27d4745496b4d88a53f3df04adcfd2afcdced
-
Filesize
61KB
MD5c748b6809bd6191062305b5da8b2d971
SHA1ca8bc3ad554de6edc1699aee6aa1f58d2d4ce749
SHA2564f54a3abe1452e52198b1071836e0d0520667a10ef136a8b7b4d7d3e6789432a
SHA512c78aa8fe15f19c4fd73f63e5256ea0a61731b03b8532d3b582d31b685ef8bcf02fae99177a207a638305721d71686d63770c09fc5ec4172febec267a4720c93b
-
Filesize
355KB
MD5a34c25b971e2204de409e10982b2458d
SHA1a60005ff99f77f8da4da001a2b3d9afc248d3891
SHA256c0d752e7b56c1985d0d0ffb8756175d3005a6fd92a13ad7fd7c0a935d9c77d3e
SHA512f60113b8bacedf9a850251655ad99824027b7cd6bb7850b94ec490fd4fb5dec0dd18c15629a0a5dd646eb7f58836c32c1eaf5c73d5f81dbf2585c9b2ea08d918
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB