Analysis
-
max time kernel
111s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-01-2025 05:06
General
-
Target
f68de850cb61683c5c0daeb96931fafedca67f1953afcb4cbf5adf7c9e61004cN.exe
-
Size
218KB
-
MD5
f2f778f0acd2ba8823271e460c2db610
-
SHA1
e0ecea3b3fb72bfe1d3c25262ca8debc1d2fa2f6
-
SHA256
f68de850cb61683c5c0daeb96931fafedca67f1953afcb4cbf5adf7c9e61004c
-
SHA512
eee62b7a5102c2d8474389025940a023d8236dd7c5c22ff171a6d46431598d2eb9fa04133efabeab761322c5609c82da17176293e92126eb64d7e5c1d8c9dbd6
-
SSDEEP
6144:/EQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:/EGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f68de850cb61683c5c0daeb96931fafedca67f1953afcb4cbf5adf7c9e61004cN.exe"C:\Users\Admin\AppData\Local\Temp\f68de850cb61683c5c0daeb96931fafedca67f1953afcb4cbf5adf7c9e61004cN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5035c3c725433f611fa94ce65752346cd
SHA11369893e1e9c63c0240febd5b395e7493f1a1b3c
SHA25649e7b9a62e297e171b8866fd515dd07959632098fcef8d90d6e72b0a6eb800c3
SHA512d444f2fc36d7189189f77c936b1c972392bbdb08947036cfe6b048dcb2e0d5b73a022996f0e82127a22c942cb1202a99327d50ba547c952922f38e55afc346fb
-
Filesize
481B
MD5aee7a647ef512219e71bb891ffafb381
SHA14e3125d9b204a484f8dbd6ba3f4c0df1754d1bcc
SHA2569fea5dd77ed23bf73ecb992f545d84176eddc31f39a9d989d9fcf5622c703ad9
SHA512b6a53a0f72bc2cdae06f59f476fb08c8ac7e2d4df87bf78d37e02d400bfda60a7918376cdf1ad057a136077b3671e8b1adc52f5da8bc655f4985f685a0e2cfb8
-
Filesize
218KB
MD54eaa01a67cb9e814a507d41f88be85de
SHA1ed4b42488cf7a7d8b30e57f28b5e1b23810933ce
SHA256b35b4d45234d13725060b00e6ae453bb53bbba0ce98b1d69738d0d53d9c1252f
SHA5120616f164bcd9ccb387dc8c2d9220d09099a990fee132924ea6ace83ed1d4c1d2a9a0f4043c66a05265b9417f437b390ae3ebbca7340d719f35c10b0c16fd5191
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB