Analysis
-
max time kernel
114s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-01-2025 11:39
General
-
Target
9b20be5bbd33815a0049cadc388dd05f258f2ee872a3f683c1eb9edd854567bfN.exe
-
Size
218KB
-
MD5
dcf73d3e53cd8c11458bfcdb05bcddc0
-
SHA1
a941a8a176a9fa218532c5a357ce5195db8fd253
-
SHA256
9b20be5bbd33815a0049cadc388dd05f258f2ee872a3f683c1eb9edd854567bf
-
SHA512
bf02c5bf35aca1d01e653699b9f72dac1b68e1249dacb4a7e60be63c333a4788bff60612ba2daa3dd28b0617fdfe44280bc690ecb788b452fb462f074dad6bab
-
SSDEEP
3072:Evm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:S1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b20be5bbd33815a0049cadc388dd05f258f2ee872a3f683c1eb9edd854567bfN.exe"C:\Users\Admin\AppData\Local\Temp\9b20be5bbd33815a0049cadc388dd05f258f2ee872a3f683c1eb9edd854567bfN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
12KB
MD5e1f035b24ce0e8137682b703d19315b5
SHA118712fd6ad888c146237d187332ccc904ff1f032
SHA256117ea4f0f411e1aaeab307c087a57678abcba7e6aa96a5bd1f2d5d7026d453a0
SHA51217a428fcea9d064e8318f0ef30da88c713209f5d591d2a4e9725d56663acdb96996569693804071aea17ddc793eade219409c4548e48d1ddc8814662236bae7d
-
Filesize
61KB
MD511db8502075f0709678baf89a5e49071
SHA1a44f0fcf663a334be1a8a16143eca339205f34f8
SHA2561f2e82b31ac9709ca27760a2f2bdd53ed282f21210b4cb7734846dc638e3ce95
SHA512f7f10c6d68497a771f3be5d6d5cf0d40ce3078081b56efe9ba9fcd6946afa915bebe936323248753a6314cd1f3b8deb34927d6df6d28cc29d615c721fdf3ae30
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD59d6ea78e757a973663dad6895582a5c1
SHA136103e6f631f917ee5c6f48ed0f4b9b4d90bca7e
SHA2561307898e16bba194791d8c5a1b2d408a6fafadff780aa7fba49209e345d3d693
SHA5129403ca3c4f7ef5b771ce6e120bdca8fa0b183aa2ec6b52d95409989c973b2e5758f48a81f15c52e4643c889d09408702b5e26a2a80b477e361af09ca693143f6
-
Filesize
42KB
MD5f5607f5482979fc96158f02ce7cf15c4
SHA10d553dffa51c7dde3ebc55a9e8526f21470f42a9
SHA256164aa498bc6b06f62aa3fb2c00f4060acc64b5fdbab163468dbfccfe6b170e29
SHA512587f5669905b5c1d09c86fcc06c9f3f9c94a778f6375b34ee7e874c1575bc494b555fe247cae85ffa0397c58af36491d898084627764652cd0ed2a15b3e57924
-
Filesize
42KB
MD52e3628e828e9cde4dd15e6d3bb78852f
SHA1edb2fddde9f2115ae9868ebfbf4a517614c0d7b8
SHA256d7eb8c0767c288b35919a419a8a1a45e5135c9f538109f6da306a2d2325e43e5
SHA51296b444fd79e688598ee5cca67e8b9882393addca45ae6cbad5de86f631bf658ca5ce9d64f6c9bb1df55cfbb6691f55d0745e6bcd50ce8d441e57a87a73419859
-
Filesize
218KB
MD51cbe8c749524accff7c7aa809d05184a
SHA1caa9c3fc7369573b54a249450ff6bef13fe5248a
SHA25629106811eada56eafe578729c7842135028422105e5b8ec860065531129e8b21
SHA512d5bf3e26051152477c3f9e5a06d447f04ddc416ff46f84806a0d12de4e05c44ac83494e84382ac0c904edce2710a557c07d5481f2c286382bc2cf79326dbadc8
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB