Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-01-2025 07:09
General
-
Target
b02a3da2e4f3a56290e31ca3319e7f2a390ea336df34d9225178d67d9c03fad4.exe
-
Size
218KB
-
MD5
6c16927895f35a9154cad0689dcc2261
-
SHA1
18fad5793b94e99395091990e9d80ea56776e055
-
SHA256
b02a3da2e4f3a56290e31ca3319e7f2a390ea336df34d9225178d67d9c03fad4
-
SHA512
e503f896db12cb9e916cdb73936efdaa5c609133744bc0d8a6cabcdcd8002b84c812d7a49b4376c2387b95ff84b55b7cfdd87d60b763d10eb71d637aa97f8fd9
-
SSDEEP
3072:9vm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:x1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b02a3da2e4f3a56290e31ca3319e7f2a390ea336df34d9225178d67d9c03fad4.exe"C:\Users\Admin\AppData\Local\Temp\b02a3da2e4f3a56290e31ca3319e7f2a390ea336df34d9225178d67d9c03fad4.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5ece2e5a1b3dbda96e523f20243018440
SHA183ff7d19b41474a75db948ab45b14af8cebae11c
SHA2562df64ee8cd159c871211a6748dc9744da07c129b24fe1c6dc1e031a5743c8e9a
SHA5129b474b46d7250a9da42b36907940e271c746b0b7246ddbcd905c3d80266db3a83a7e29120def2925368085de90203cc53b1c7bebee29538471969cfd859bf0d7
-
Filesize
42KB
MD552a76f44e04a0b74431398d70dd0c588
SHA13d5a668416336a05d12c6563c917397b3aac8910
SHA2563de156e97ddd1d940a3d9241129203ee7e3f7f89b643e36537215c37970c30e4
SHA5129342b97e03c3fd4ea4aa3df3af9aa28a178358d5f0aea636aee57ddedaffcfe971cce0d71576046916e8a61a1e03f465389c23ea5f5da6bffeebea74ff8c7339
-
Filesize
42KB
MD591bc6133cf5e4ffd880e90a6ea537418
SHA1fb5a02c971cf73917831c0c440ac448b71ea3313
SHA256c1c1a2d37bae44528c937dc99f74f4e5c08c6ba05f3f81c9ea4249151a1bf75a
SHA5126e48788837f3feea8dfd39d0d81220aeaaa2d8dcaf03998eb7fe5b242f69584d8b6872bd84507ac4f419edb1445fa7db0aa5cfaa5083578b305faf50b8ba04f9
-
Filesize
218KB
MD5de57c7662a114378e99cf7a398ff6da2
SHA1ab6debc2b00ee51e372b724624d123bcd61bb3a2
SHA25623fbd36f81c51209ded17b477a83e33c83b7fafa90548ea68a148e22a32044ef
SHA512c017d42534335634d19ece864d64bb129a6503039d4594dcdbb4b060ce8abe0117316cfc5e28fd47882a6436445a623ddb5412f4cfae9c390a23a1f7b15767b2
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB