Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-01-2025 10:57
General
-
Target
c79e956d11294f55ba95806452c7650d90a776ae43d8b48c59af45d5c526647a.exe
-
Size
208KB
-
MD5
0722b34dd495b9d6ad8b40979a99ddc9
-
SHA1
1869a082c458257760f89ea64f0ad6e6f7e02935
-
SHA256
c79e956d11294f55ba95806452c7650d90a776ae43d8b48c59af45d5c526647a
-
SHA512
25d9890b75487c7bdc0b6f7090e5c77bfa1f3ce7fe8317bc5531bdcf3bc48ad90384b8df61504dc941cc56226295b663c57052810a1e4a647df2cfe8a7a9fb9c
-
SSDEEP
6144:oa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkw:obapK0JCmRcU9vVokfD
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c79e956d11294f55ba95806452c7650d90a776ae43d8b48c59af45d5c526647a.exe"C:\Users\Admin\AppData\Local\Temp\c79e956d11294f55ba95806452c7650d90a776ae43d8b48c59af45d5c526647a.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
42KB
MD589ebfa2423a85b4cc1316f23d768a0cb
SHA1279001f9e86cffad5c7d90cacb290db368dcb0bb
SHA2569c3a70eb689526acb8802164ae1973a2426838b3171dba5d339f84f947eb18b4
SHA512a77d3e32206b9e0ad4c4167ab3eed2b746f72eac627e96753012aa93acd7e882dd7b29392f36506e0d00ff4a165009e8a198896cb61e0187b0fca9850986da5b
-
Filesize
12KB
MD5e1f035b24ce0e8137682b703d19315b5
SHA118712fd6ad888c146237d187332ccc904ff1f032
SHA256117ea4f0f411e1aaeab307c087a57678abcba7e6aa96a5bd1f2d5d7026d453a0
SHA51217a428fcea9d064e8318f0ef30da88c713209f5d591d2a4e9725d56663acdb96996569693804071aea17ddc793eade219409c4548e48d1ddc8814662236bae7d
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5d8adb4046f82fabee22731bd2b17fa55
SHA13a740c3f8729edc7c08062dfe742dbe76f690ada
SHA256e9e20466ba0ee2edbbfcadde65aa0693853e9b32be2991e1b947822bbb3ac36b
SHA512ff7e4fab0323d589c0e4cea7724e15f7e3723bfdf9d18b1e79bf167ba3c7665cdfc65c57618bb8ed918995f5ca4b9176c94539b84a2806ee727dec9202d3fda7
-
Filesize
24KB
MD5fc648c11f870562f5214f89057af906e
SHA111997931cd35e162dc61e34bffd71018c149f9ac
SHA256dbd79354cf12e16c8cd7a639a4b776cf831a604b6b20a435a0a1514fd251e101
SHA512062b1517cee07270e7c103f32eaa141afd065a813dbffd27b7acd51c07a6238bce4087dcc04f705cd9a19eee99602e82e402dcc202102301d91108f7eca77f21
-
Filesize
2KB
MD53ea4481e35f721ce69f45825672a4eae
SHA1e6931835e52a77595308011254b380387097c503
SHA256a558f5ef6ebb54f0a641ff701755e96ead6538dec4cae1fd5682c37cdf3861d8
SHA512a3b31667966855bbb64764a217b4974388bf9f345c45bbf62a813247446e34ade93f0667b2507a9efb96607c08172f6a97e23f5eb0c93808e6a30378293408f4
-
Filesize
42KB
MD505bcb9b4f437fab3c72b5b5b04ef95a6
SHA19fdf90314f0008c593a94ae6ff4c420ee809ce1c
SHA256692853f73dafe871594e1244e1242568ac4c4550b5b4fc94ae736285b651b48b
SHA512a7441463438a2d714ce97dc9dc25ef25ca8fc97037ace5678e423f35a3bde4678bdbfbf2acffa868d0e991b476053820693c73c309fe2238f71cca5605af2288
-
Filesize
24KB
MD50bb62e39cf35bcfbe9b99b5fd0c0ab55
SHA175956d72ae266d74d34b39dd4fa7645bfc235523
SHA2568771d770bc6d8bec94510b6a97d58cedb5ef9db21113ae984e1fd857897773c0
SHA512fbbaf2b4cf5914e76cf9517408e33f04148f1ebb8f2da2c6ab9a4a2f49f6afe3a0eef5dd23211cd118682354a31250c677fc90025eda1ce5026c8c2312483f96
-
Filesize
481B
MD541865bd0bcc76f2909e3a73675d11312
SHA10505f631c96117cf0834e7c6b0b6c41d034374bd
SHA2568642280e0824c04ef2238a4d6d5c79b1d4002a52823661abee9f1ca00b4cd87b
SHA51256641b8d51db2420e4f290cfb0b6df174bf136bf2e9f2321a85b60065f26639cd22a631dc0affb90802c04b4a2875a76b989b283b61a596751123ef4fe6afe19
-
Filesize
61KB
MD543abd345746b44764bd49180e47d8ed3
SHA11d3e6f7ad87b554915dcd6164906770fa76ee56d
SHA2560628315bf462c97099f6259b024e7bcbb29b6161ce65401bfb69553327f2d922
SHA5125025af25c4e61e73ab35a918f5f0c8c546e7e541dbe1a7cdb4a87b0b4cdb379e93dca86dfd4266d0542cd58032d9b96941830b2d2cd1119fd3d2f90b7704bc7b
-
Filesize
208KB
MD5dc5e02e3981f285425142cb7a071baa9
SHA107a5b12535710bbefff588700a4eeebdaa14d29d
SHA256a9ef5a96722fdeb0d9c6e3bd9c680519261409951452e9ab9c790bc12ca9c92a
SHA512a124920f2ae5fde3d726e61b3284286ec707a44c91b7ea2eb025914866155c89890b33d8e32a4815deec878d0d8ff631cc80ad0bdfd7c25a337f85c31a9ad117
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
412KB