Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-01-2025 06:41
General
-
Target
2994c5ec74db96b5a86153146de2d60fb81ccc2bcd5ff4722a81cf3586afc021.exe
-
Size
208KB
-
MD5
72ced6d8aa79307bb2bc9d9bdcd67b25
-
SHA1
ef70a7ba4dff4457ff123adf72a730e32a63c4ce
-
SHA256
2994c5ec74db96b5a86153146de2d60fb81ccc2bcd5ff4722a81cf3586afc021
-
SHA512
dec0a21c2c08da7281f1bba6bc469704265aee2082c6aee884ee6da42febc604db5fcc3b1c727300ad95c4ee07fb937beedd4fd1830242cb5522e16499a187ba
-
SSDEEP
6144:za1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkA:zbapK0JCmRcU9vVokfZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2994c5ec74db96b5a86153146de2d60fb81ccc2bcd5ff4722a81cf3586afc021.exe"C:\Users\Admin\AppData\Local\Temp\2994c5ec74db96b5a86153146de2d60fb81ccc2bcd5ff4722a81cf3586afc021.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD54673286514d9625b3b879a83f84935ae
SHA10faa344b108f9fd93ba11962c6b9be2170aa6cf5
SHA2566f469b89118e760fa0ef47659db74c6f0b6a1cc51a18dff3b0806736abcfe24e
SHA51273031092463dbdb1f7c7c1844d2189549853b9ae231afbb6ded1a242d5f85d693376ca0f88db659229de7e1dca312ce00724c327c39d5dfbfdeb3d380b73a0bf
-
Filesize
41KB
MD5a4348433a7c8d05dce921b10238f0681
SHA165cbd5997a68b0909e4d6ad73650b5fa4a6b2e82
SHA256a6d6fb6b7366c986c8366fc3e02eb4211d84085b6927016d2be70c97f3aafd72
SHA512d2efac9490c445fbb9daf5bcd713d12eaa3f10d15f056ad3db40e66eb0995542a56eb1a481e446beeb300bd3eec98703625f594b875f1b8b4e79cb65d77350f6
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
208KB
MD573877b9f87b619ddd5f8a8b609537771
SHA1ce47296bfa3b99b15fe146dcc789fa22bcc4e1bb
SHA2562b2c5ed70fe93c9c88c90916cb9b78b71b97c93f9efaba1cfdeb62f4dc76f7b7
SHA512cf3a2005a15a68ff551ee33ec6051393a6c307aaeae3ebaceb3f98c0f2bd14ef43ef97434192399ba6f9f6ea62ab12283705118d3e1b81f4f4971657d505d179
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB