Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-01-2025 02:56
General
-
Target
67c4497ada8f65b2feb599290f9a139710d690621b4a0886b207d2de2750a6b7.exe
-
Size
208KB
-
MD5
2e53e77f7e9fa1e401aabbc9882bf407
-
SHA1
0e3d06196dc59e79118075da4b756659907c0326
-
SHA256
67c4497ada8f65b2feb599290f9a139710d690621b4a0886b207d2de2750a6b7
-
SHA512
1c0e588a77720ab11dd99eedeeae6b0d4ef5eaf693d3b718024c2c4e48d5abc08e5f781d59f7bdc84d3358b0a7c4019e3654f54dfed39189d0d47b8c0d802b0e
-
SSDEEP
6144:ia1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkw:ibapK0JCmRcU9vVokfD
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\67c4497ada8f65b2feb599290f9a139710d690621b4a0886b207d2de2750a6b7.exe"C:\Users\Admin\AppData\Local\Temp\67c4497ada8f65b2feb599290f9a139710d690621b4a0886b207d2de2750a6b7.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
42KB
MD5fc274863e7fbf94b180553005f175f9a
SHA14951cb7928077f7eb8b7304c04a64381988d1700
SHA256286663d0b0928f722c1f15b3d8a50078ad3b0f4be7410e6277067a84625a3bf8
SHA512180314f60a7147356448dc18e1a380a0368c681410c601ee800902a804c62a37ac5d93f7ba94d7b9f5b96106370085fd1764d4b14a60960d8455395c4f790a18
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
61KB
MD5a2977eaa523e2d6bc2a9580a849f7c38
SHA13489af8ec2c4b039d0c37f3507b6a1d69d3bfbaf
SHA2565339a1f15a40a20e8fb05360eba9b41f3b5704f9b2a47e9ddc3b082fa20b650f
SHA51246de80d6446219e50ca0f8fbb7155a75844aeb1f978d965e5632079d614a3bb78a50b66cfdb762536a17e254991da5cdc5b8f73f25d89c22a6766f5d04e0283f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD56e14e2980f25aa147a5ae807217c78df
SHA109d67eaaa84c1e244e6adbcf4627b21ae7cec351
SHA256481598b7ee22227f59c1388d3f7130ff75e46b5c0a8c3392c49f576c12de7449
SHA5127793d8b39e4f7bbf06fe39eb90454c9de454d25647e56de685a2d1309cfeb156f191de0f8a8dbb77e5e721812d4df3578ab7fad5fb79b54109869613b5b524ac
-
Filesize
61KB
MD513ad16214ed5a56971463f64b96fa4bb
SHA15e7c789c971e5224a9160cd02e30de30b72bbabd
SHA256520a4293e47086e4c9b73fc9142f92cae329176e321fb9a81459b95fc99bfcf2
SHA512c4239e385df8227aa9369424d1d7764681197579d494fbacc23b6bec2091c1ed022928fb33cbfc8bef9ae884cadaf2beb9b021e2d43d5801227f3d428b32499f
-
Filesize
42KB
MD59b33a3ac2c86b98ed6e6a4ee3066081c
SHA110577f142c415874785e0a8dec18a9cb713f964b
SHA2562c1c81876b6aefc6a84cacde82fc4724cbe41635c977c352346d483e4faaa3f4
SHA512888c3f2e51e410605d406d61b147467c33cf317e0942b5a1dcb4ae6e13adcb8f060266c75439c390961c32feb226c57eb0172793936e6574ec1f9774296f893c
-
Filesize
208KB
MD556122b0ce01b6621edf243a1f0e880b7
SHA177c18857a6c6c02c89e22acdb0ac9419e36758e6
SHA256bbac843c1ffde5ec16993d0fa663081b856a09a89c2c162e3424bac390624fc6
SHA512f649128bc241147aede3761189fe1ffdcf5f3d7992a6d92fb25d3bc567cbae796195e0fa79fa41b226c14eb510055ce83c948b41b64cd4bbe82d7a4683533a3f
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
412KB
-
Filesize
380KB
-
Filesize
12KB