Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-01-2025 21:45
General
-
Target
cee976e230b3cb77956bda6d012888f8dbf95f8e9b23432a5a29923d27f9da2e.exe
-
Size
208KB
-
MD5
6a8eac5f5b1c00f55991b728e11987dd
-
SHA1
3982a1bb6c192db5f5efc2240afd38b1f6b0b253
-
SHA256
cee976e230b3cb77956bda6d012888f8dbf95f8e9b23432a5a29923d27f9da2e
-
SHA512
010d8bac5349f0981ad6a874ecbb0bd8df15d56e4a9c9eda3986c6727b84879f6749f0b2957103a6ce2575f8fc308a9671d42c60c51ec51124891970ef7a0cd4
-
SSDEEP
6144:VJRDxRqdSqQts6iRZsTZuDbhivDVDN8zqF3X:VcjQKUZigDVJ5x
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cee976e230b3cb77956bda6d012888f8dbf95f8e9b23432a5a29923d27f9da2e.exe"C:\Users\Admin\AppData\Local\Temp\cee976e230b3cb77956bda6d012888f8dbf95f8e9b23432a5a29923d27f9da2e.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5324adcc1eaa8bb6af344ce1932391529
SHA111e53b14c134f754e084984c0a600172abcb7dc6
SHA2565a48ae01594df5526899bc7695a61113d04fc071d0e2e35b5e7c5ede0aac8e05
SHA51249db0d2e0ff370c361b1b2c2d91050a183417b8a26a8a6840edb859da18bb6ba50718e4590b691ec87f7ede540f672d582e6c95c481d86aceccc0cd3dd7b9a75
-
Filesize
61KB
MD5d2b623b771c9550e5d62ae85ef7077bb
SHA1f91eaa5ab60f26321f42473d167f67317339bf8d
SHA25649757c3941197b271837ea76ffaa86b365b9bbc3025d131f9d26c0c6ec625c8e
SHA5127986f9db855954b07ed768199834ff1d93218c9a6ba9cd532facfcfbcc586a34eea7e538943aaffe5b711b3aa8afc3c7c521ab1d7fc8bb3e374ad4180b2ae975
-
Filesize
481B
MD5a66bb0cec75436dddcb4589585a43029
SHA102f3fb4125b9addd10d79facec75da3ef8a11ee2
SHA2564c515cb42ab976c9fe871d0137241fef98e6da0c6315e198830985b255fa7524
SHA512d207d53a3679d955192d07417d94c741630c695a75b334ab90ba9b5669d56eba281429b12e13a88b64262f530813fd2b6279a535970b04bf844e6e66dede0e71
-
Filesize
208KB
MD5548c8f4f5ccfc353b163f8d1865f2c76
SHA10835a9b6ad497ce1c125907066227d088ccaaed5
SHA2567aee24c1520451fc2ad97149abbf7bf1892d2fc8547af68e55937f4a91985a85
SHA5123208ba219e0e7ab90449a54edf6e10f4de57ae9d83711236c47ae4d85fad60e54bafed14fcc2f47ee0e393972ce9920d7f9842adadffaa81b80ba5828270f428
-
Filesize
964KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
964KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
964KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
964KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
964KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
964KB
-
Filesize
728KB