Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-01-2025 00:15
General
-
Target
3ffa43f5acbf5d4bd41cd7ba18a20b629dcafa309b64a96d9068dc5068b0ec56.exe
-
Size
686KB
-
MD5
a0d856e53b15537e64dc67239f202230
-
SHA1
8645b18e9e472a28dd2ead23decc41598e25cf1b
-
SHA256
3ffa43f5acbf5d4bd41cd7ba18a20b629dcafa309b64a96d9068dc5068b0ec56
-
SHA512
f120964871d5002a898e7eee7a804b89b8c53b1c76282322c0daffcf16312fe8dd7145f95951a4c6d40374290b51407a2d51153b5a83d152bde3b4044be013ca
-
SSDEEP
12288:WmWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgpH:WmUNJyJqb1FcMap2ATT5itjCYZ3DSoH
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ffa43f5acbf5d4bd41cd7ba18a20b629dcafa309b64a96d9068dc5068b0ec56.exe"C:\Users\Admin\AppData\Local\Temp\3ffa43f5acbf5d4bd41cd7ba18a20b629dcafa309b64a96d9068dc5068b0ec56.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5b949070e478daca070edd35354155c73
SHA1770b43871223d6d57f104c90c25d890b4c81564d
SHA256e3a1258e5e0b935320fc27ad659a75506a2db17a573f34d477cf6c56454b481e
SHA51211158f6beec3b80315a062ef0eb4641ec976ab2ccf3fc266dcd2f19f2f9bf088bee1de207934aaeb18777650b62041b188598722c93678de8f5b884badc56139
-
Filesize
61KB
MD5dfae28573269010d0c989c3cea3124ea
SHA1523f1870bd805910579ace2aa383de2ed5c6e6dd
SHA256ffa4649036e091bf237e5e5de1fb0714289a45a790f102633b4ed03b428227fc
SHA512005d0723bd72a512af223352977876812a5ee784c1b5b2188620de8be9360a48839abb51491da27f3fa9fe2a171e189fef93da85ed05d2089be126b096138222
-
Filesize
42KB
MD5ec917d17e1287a06e2f2eaa7fa841aaf
SHA133f71b8491bc9975344310c9bc3666709360a0f9
SHA256ae780022f154f50f65a43ccac6d43c875f650ccca959b9d226a41064fa20c231
SHA51205fddbe119b7221803835384af6751dc9ad2c13edb7053a755d9798105414c18583b6f2687af5053d1915f7e87bd9538b71913ca35b4c18a6462ad7d07db945d
-
Filesize
42KB
MD57f6e16faceba14dbaafefc016d6245d3
SHA1d2f49d30c832c556a002c3f93cc8f91fc89a9cd2
SHA256251ae1ae7f6252f644ac9ee35db67f7a9ea38ff6da8d89674f7832367e7656ee
SHA5121797d9c09bbfc30d09085e8607df074b84114a70a182966e2d77f580967c94e099fd6f8017691dc1f8157c1a849bcc3e94dd105333e48fa3b28523dbc9ac066a
-
Filesize
686KB
MD580d15b6b860d00b9cd748d198ec05ea4
SHA1018f5423cfbd1f95f3c4cf620511afc01899572e
SHA256fe9ae472344bf97033f796afbf55fe5d217e906f654913058619c49217fb183f
SHA51286f042d1db6a89f0930fbce2dd6dbe1d9afed282551c852f5e115819f5b5259766cff800d6a5f50e8fe89150afbdaca78e06354503fccf9f2bbfb19a8d3d22fc
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB