Analysis
-
max time kernel
111s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-01-2025 21:30
General
-
Target
cc4095314588737d0003f6acfffb9ecf528f6a6d5d3a4dc0ca38b16b77bda251N.exe
-
Size
218KB
-
MD5
eb1c81b88b53a98da20f3a8e10c28c20
-
SHA1
b8a79644e038d0aaa398b59885c22a97bcb04c40
-
SHA256
cc4095314588737d0003f6acfffb9ecf528f6a6d5d3a4dc0ca38b16b77bda251
-
SHA512
5a605de7a656597d1f0a98bf468352bcfce731ce19fa77d535c4d180531b8fd521ac5b0524dda4e6b01247d3ef89174aedf92279a5727df1b4aa614dc73a5c62
-
SSDEEP
6144:cEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:cEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc4095314588737d0003f6acfffb9ecf528f6a6d5d3a4dc0ca38b16b77bda251N.exe"C:\Users\Admin\AppData\Local\Temp\cc4095314588737d0003f6acfffb9ecf528f6a6d5d3a4dc0ca38b16b77bda251N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD512fae48326459b0ca14d7a361234a3c3
SHA18985cd5a17af1d9c46321263ddbdcae82ed8823c
SHA256540c18ddd4be8522497ad7ce166743978d4e58024d22c1c8e538745d95eb8d54
SHA512677963d9372cac1114030c9715210d9da98042e642faa2dbb3bbc261fa7771a239ecd7c356a075c04ab718a067a203fc3c833bcce183e6fe7653b27a4fa7a967
-
Filesize
218KB
MD5625fa3cdb9a3fd11ed1bc598b58ce489
SHA12838a557f49900736215906c42e53d26d5377739
SHA256c5d6e7e4c690f6e94f31b26059c108f9c862038f2a084b9895bb7c470af703d2
SHA5124388588313f5b3e844550f850dc68095d515c7b3b2bca6d5399723de6db827de599bcb4ebf8d1d8ba85b092c2f10ad1e877dc65ae9a073a4eefc9bcc45c5c165
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
324KB