Analysis
-
max time kernel
115s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-01-2025 03:31
General
-
Target
996f9f0bde22728b52ba22cce12757e2e81ad5c144137efe82f31e8cde40d5e4N.exe
-
Size
208KB
-
MD5
d0b710f99d0cdef0d1dd367257238cc0
-
SHA1
8a6d9f027a201558437ee370fa006d752ceaffab
-
SHA256
996f9f0bde22728b52ba22cce12757e2e81ad5c144137efe82f31e8cde40d5e4
-
SHA512
9669eba3ba598a9ec65d810b147fecc9d54646c7cc8df2b1980636b57b3185fa708595af49ae4082cd55309f5c241ce49739cf2e3bd5190acaf9715db682495d
-
SSDEEP
6144:ya1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:ybapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\996f9f0bde22728b52ba22cce12757e2e81ad5c144137efe82f31e8cde40d5e4N.exe"C:\Users\Admin\AppData\Local\Temp\996f9f0bde22728b52ba22cce12757e2e81ad5c144137efe82f31e8cde40d5e4N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD53d680efa941b316ed7e1965508401fe0
SHA17042dfe7de126497fb3a2c5961ce646711efac35
SHA256c145a957a05e489c6c4318afe3f37d42027eb67afc6b28e1cd770fa4611ba3ad
SHA512abd7ba11eba7c9e1e397ddd173d50fa50b8a2b76a66412d151cfc7f35c7e941e1058c66b206d0b5c37ec9f13712fa95a58a0cd595084d3203af41423ecf1c4a4
-
Filesize
24KB
MD59d823d5e1800ba64c560eb519a35c515
SHA1b2bac378137344f2c2fe2d9b7db26325e66ce798
SHA256940fe53220b34862e967f800a2dceb0b4ebe7fdf674c1296e877533a7bbe9500
SHA51215c86467cce76747bdee18f7b772875ed6cab7535daed9eb128bf81475269fc2f6d6086471f606171beb5d30536dee85ec9d5c9f43069295f58ed6bc724271f7
-
Filesize
208KB
MD5c80494f9277f5cc0bc861cf7e29b37de
SHA1c0c5c10ec2b34cb84a7c6a763754c3ceaa1cba02
SHA256b3e5bdcb3b97916ac6e9e521bdcdae4dfd723793673f34459c7a7b764803f5eb
SHA51215342511a304a323fe2751572e1b26b5524951d20fe7aaa3ef94817e802471e66b6cbf8792954d323c31502a9ac32f6382882d7b9efcbd849f3e25dcc89be9b0
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB