Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-01-2025 02:38
General
-
Target
d9f71c50936a1ad63ff2d173afa86f0b2375955784bf1b6a40869d47407a6974N.exe
-
Size
218KB
-
MD5
10a84703b73578c9b1284ac265018e80
-
SHA1
61f446056b612f0a333ac4e4d5b1d752cc6547ee
-
SHA256
d9f71c50936a1ad63ff2d173afa86f0b2375955784bf1b6a40869d47407a6974
-
SHA512
4ad6ad997d9e4497dc05c3ef13ddaaaa5d0d8d7e579fdf5d5b402bc0abbc224bdcd40d8accbef59e9255f2cfe0a4f10a8665f1fb087d6ea8674a41efeab315e7
-
SSDEEP
3072:tvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:h1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9f71c50936a1ad63ff2d173afa86f0b2375955784bf1b6a40869d47407a6974N.exe"C:\Users\Admin\AppData\Local\Temp\d9f71c50936a1ad63ff2d173afa86f0b2375955784bf1b6a40869d47407a6974N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD54bcfc043fa12585fa827898ba6a16dbd
SHA1dff6e75b7e7cc0c437c546a6669e1ecf252364ef
SHA2569192f9a358896b68f0b14b91a37f3f3422662ac8a54c9603cfc16835309479f8
SHA5120df6ac773eef986d47d3e5caa58e5848382f00e5e4f2ba67914d5258804f0eb8aec9ff9a5dba444fbf18c9c65f9ed6b5d522f8d9e236a299dd2925edfa65603f
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5022e44d2ab3178875ff0176deaf36412
SHA1557e324ab728403181c655c7ef7eee31dbcea3ce
SHA256926de1e85936a3526c21a6f9924bc540706b4083dfc8f6e8d797c6d3793c1f0a
SHA5124121f137862d666ab3cfa224b1238d2f29b6422ee46ddeed791bb6816f1acce02b5984f00ef7ef6b72724a1036fda254407f46bad9437b74305b1e766c574c1a
-
Filesize
481B
MD59301eab3d586d7de0cca4fd7318a2a0a
SHA1fdc59966cbfb0438c7be31d387749ecaa9fe822e
SHA2564290dfd78d319763835b16c7dbd5a78edbb80197e5ebdaa12e86d50c27c8e41e
SHA5121004aaff10e09326bcf824923c9fb035bbd69f9debb583cef0b0bfd44583387ca802a3cbf2de203795a54a7409eecf7f3728d9a501909a87fb511e444284c398
-
Filesize
218KB
MD5e0cb6bc90ae8f4127fe81a9716f0744d
SHA12e9a3c1253ffbe41f638c666a30f871942c735d8
SHA2567e53d4467edac6c4a7b53158f95382944cb3f105ac915ee2daeda54416e2508f
SHA5129e6dc1308121ac772b5ceb153121e5eca7926471ec2674e8f51facec91ef88301de3b433740fa15c4136255d39c3b01f16ebd0a4b94af79d91a0530113561134
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB