Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-01-2025 17:52
General
-
Target
020702d4c03e110898e9beda4de7da2463879f4e04e01f09488dc40a78be22eb.exe
-
Size
208KB
-
MD5
a6a7e7b150eb46f192c4ef733a4542a0
-
SHA1
d81d8e12a465a1a5b65b1cc00c3504ffbef2d032
-
SHA256
020702d4c03e110898e9beda4de7da2463879f4e04e01f09488dc40a78be22eb
-
SHA512
c9fb2ab2198a07eb217dddc3bc5e332be8cc51306f020b2c4e1b07efb3468c7ba7a8c1b7b5ef8c1a23f832ef185d059d8be6e7e691c9fe30a0c84cf50770c30a
-
SSDEEP
6144:ya1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkg:ybapK0JCmRcU9vVokfB
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\020702d4c03e110898e9beda4de7da2463879f4e04e01f09488dc40a78be22eb.exe"C:\Users\Admin\AppData\Local\Temp\020702d4c03e110898e9beda4de7da2463879f4e04e01f09488dc40a78be22eb.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
12KB
MD5e1f035b24ce0e8137682b703d19315b5
SHA118712fd6ad888c146237d187332ccc904ff1f032
SHA256117ea4f0f411e1aaeab307c087a57678abcba7e6aa96a5bd1f2d5d7026d453a0
SHA51217a428fcea9d064e8318f0ef30da88c713209f5d591d2a4e9725d56663acdb96996569693804071aea17ddc793eade219409c4548e48d1ddc8814662236bae7d
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
61KB
MD575b5ca1c7d39044bd7b2098deed0c398
SHA17f0d8325339ce884c21f835801ebb354c5c895bf
SHA2561e4d618b63a2ad1f91d2b1b047f1bbb033f8d4139ed7400af90262e728639b0f
SHA512965a9cabd2dd61db3d8f162adf3b5fe3211176bc7ce4597ce9d331d826c38499e325d66b93d1ea257d55feb5eed12ce373e18124f86b88c786c1835fcd76dcf5
-
Filesize
24KB
MD5d3e3f12f1c44bfb6a7d2db19398b520d
SHA142de79aa8fe73ed8431fc3bb50d216ef1d8c58ed
SHA2569ee3d098a710aeed2c329983dee49e0f75938b6d37bd8c83420def0dd0c30b67
SHA5126cda695de703cf749e22c3833d38451f1d5920b0f4c986d19707eaa57e7c08c68445c63498ee50eaed2285bbe99b91968315816b62a70c8c79d08c3a0a44474d
-
Filesize
481B
MD53d44545397f21a6619f76d875c387493
SHA166b3e86268629e1e451b0a8e86484f86ef0b06ed
SHA256d4e39981a362555a3fda8f88c08a3203ae9b64f8426a614c27cfc922bba33ff5
SHA51287e7761e701c4b6d17326ed204d311884301b663ea2e844bbde7a790263a74f9694e36627fa39775ff77e0f0223d627a560e1f3c5b405a468ede5c575e8cad7c
-
Filesize
42KB
MD5995f04927b496f1e4ff644fe881d8a4e
SHA1327aed1f566f16a6c818666571389957a36e1ecf
SHA25609e658b6887c421d883a47b6267f9579cf242eaf6934a9952c6d5748c0c5f1ed
SHA512233aa34eece131ac01e61a4e49fd83af00fa3ef53e19109f0d5c12a91dcbb0b94b1ee24adeb8e6d3a55045dae4b19b5383012189c42cf9b45f5b2ef7727b4983
-
Filesize
42KB
MD5ec7aaa040b3cd1492756e90869b3abbf
SHA1579688d53f13d78e37b12546b387949c6a311c30
SHA25683f2ddb41bb3a6da085f6a8778971a1e03f42d0bde83a49e99a55b85c0b77e8f
SHA512d7231d32357edbfca324030308de2c7b7f339b2f6a544be4de1e6a541841c7dade15ed9ef3d4435330f853b213fe1906609791b9d93de0a2d4c54b3c424d1e58
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
208KB
MD5d63d1a7c46d93b86f8030e33e5f72a59
SHA1a43ca2d8b9e70481142a25e60beb5796eb2e79de
SHA256df68f2e94c23ab12963b69b66584b4fd9be3da11af2c879fe42c3731c574ada8
SHA5128da7f04dc36ba0bb4f76a0aa0cbfd3824d9762e780a513944e0dd12a853865ae90f44a36ce4c318de9e9944a076a984e9411c948238158074b73b23b85c4fa4c
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
412KB
-
Filesize
380KB
-
Filesize
12KB