Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-01-2025 11:18
General
-
Target
a1f61f346d6f8856bc883dbf9768a1f6d3c22a1408ad201db06c8518e28d482a.exe
-
Size
213KB
-
MD5
a34f70bb2344fd02b9d99a907653b97a
-
SHA1
9cb57b47b31c66467bcb53b2ba0997a3d7830df3
-
SHA256
a1f61f346d6f8856bc883dbf9768a1f6d3c22a1408ad201db06c8518e28d482a
-
SHA512
07f8f374431528dd56c948e3c1eb944dc34da13ccb8b2474b955114ce6f8bad9cc6a54ca0a89a8dd2716420817dc409d3f33c7b2bd8b1746add7edb81a8e024f
-
SSDEEP
6144:8QfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy6:rXkej+f4VDOEVdbgtf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1f61f346d6f8856bc883dbf9768a1f6d3c22a1408ad201db06c8518e28d482a.exe"C:\Users\Admin\AppData\Local\Temp\a1f61f346d6f8856bc883dbf9768a1f6d3c22a1408ad201db06c8518e28d482a.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD54a43abc387c18de26afdda41202e0745
SHA1e0ecc37cddb3b46d7158d072351bb3f4555834f0
SHA256f6344c21b54efbd440e9f1d4d8a23465cdaca9fd8e1aca64b7844289a592abaf
SHA512935a0d12f55437d17ded0cd05fe8de1c44aaa05097ef844c54d332f1b9bfb1d815fc1d2f79e2a8590d28e0656f600c2362c9cedeaab4b9cb72b946aba7c2de94
-
Filesize
42KB
MD559d956c922262b10c3a02c43909f31de
SHA1f0550423e3dd6436d8923023caf762d6656ae2aa
SHA2567c31599de505ad27174054b463d0dd3a6609b98a7094ea9f67d17b2828259dfe
SHA512e0f72f9dd961fd92715dc52951ed0b21e18266dc83d92262952f32cc006eaffc186b1d651b136706a4719ccb3728b80d493270a184bb7603233fc5ccff5c545e
-
Filesize
42KB
MD57d9938145128fe640756ead280a34d0f
SHA1a999f76c57d8864d093e0a341a0971386d743728
SHA2565f2c23d782904f9896dbe3c51e36c400a5a05490260a148b3ac9556aa307fec8
SHA512a0ff73aaf10c6630970c116c8cf8800e2bcc2c211f37b96a0303621e289cce31c5a1b47452eb83f26d649e2041754054f56a8686dfa01f4fbffa69921031497e
-
Filesize
213KB
MD50519cd76eb9cde0e050db75cca68c378
SHA15190be43014725e6f1db7432b3e88af904e30be1
SHA2563927d11cde8625f637cb091c5cac3773c367eda728d4543f59d67cea69a31dab
SHA512f26f6d6b55e7f303897f593d6f27a37670664352877999df19c4662e439f3b23dad02c4a5a49eebc23ece344178580d1205baf4fa7bcda72070152eb89edfffa
-
Filesize
2.3MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB