Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-01-2025 21:53
General
-
Target
2ecbf04365549b4d507643dff6d2d485a1173b8e8d5384b0f584817de474419f.exe
-
Size
218KB
-
MD5
5b8e59c0f6b99945847db661eb25f3b2
-
SHA1
1f949eebc57998327ec292ac871a11b29b4b9e28
-
SHA256
2ecbf04365549b4d507643dff6d2d485a1173b8e8d5384b0f584817de474419f
-
SHA512
d3f8ae27b1fe3fb0cea267699278a76eb1333e5fe22a1ee77522f880460a2a7c0a4c270ad9bcca1ca2c470580b9b362aac95dfe7b5b96e3dc262c7aff179f3c8
-
SSDEEP
6144:nEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:nEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ecbf04365549b4d507643dff6d2d485a1173b8e8d5384b0f584817de474419f.exe"C:\Users\Admin\AppData\Local\Temp\2ecbf04365549b4d507643dff6d2d485a1173b8e8d5384b0f584817de474419f.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD52fe20e8ce61e64860d413309c6fd34b0
SHA1ff9c79cbbef0865991abc2d2bf15787bd1e0b20e
SHA2562ba5cc33e500126ddb7d86462cde97a1d681c7d3dade562bc5b1a926ea16b427
SHA5123dcb5c825a504a9dd4fc32ae0d4fa8a17e13e7e6b89813d41a1dcd55d224592f88c1abee9efca4ec00a5c675d38624fb0b5f97884ea72fc77be00b8c61af5ab2
-
Filesize
42KB
MD5d75a27f9b849d8aa20508e4174313eb9
SHA1afc774b29c1c59edd007e7aaa417ce5fcf1bb639
SHA25639cbd67ed58ad713c1a7381288918c470002a88c38d546009fec14fc264d4ee4
SHA512d915040253fa405dfe69d67be41e654ffe0dd057c6293a1705cdf373a5e28239245e7599a40bda60ad5ecf0ff14a556857dac855fc2c8313b33b4276aba4c183
-
Filesize
42KB
MD5adce6d9d64ae09fdc403a137fe896ad2
SHA171507611dbec142c4035e89a65c1a5ed1ead91c7
SHA2566ff022720a7023cbdb97b5d1e9913aa346ab315bf216d3bf88f94edf35dac755
SHA512d12167e907a8b0a91d80111933709084c233b39091b6efa7d3638de347df2e72d587174ca1a645e1db61bc6ad625fd68634bd6a9ce5a59733deb3e91a5e52294
-
Filesize
218KB
MD5f321a3f78e4b6581134719356cf734a6
SHA19cc106dd96c110a770a527b81dbb340d7958ecba
SHA2569435cde4a0045a1587f809fbe3e7772dd724934545c57b0ccc1d5c9127f0e5f4
SHA512e2be44d6fd4f7cf964aa83cc7abe180f1f8b4ee53657206048650b7c61389651eda7fe481b261859998da9ebd96fe81e98b27ef57b6eb8033d1175d2986a02ce
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
324KB