Analysis
-
max time kernel
111s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-01-2025 13:41
General
-
Target
d20eef1be2ab2ceab4034c82bda17fc064c34bc293533c5264bfef1e58bb5c1f.exe
-
Size
218KB
-
MD5
fe45eb37cce1b5c53ff6f110ea349cf1
-
SHA1
4bb2dcb13f470534777bb5feed09fdcc3c725a89
-
SHA256
d20eef1be2ab2ceab4034c82bda17fc064c34bc293533c5264bfef1e58bb5c1f
-
SHA512
19e11df137f1b8fc0f1a04a0502cc9d09c9b87c034c27a30920393fc89f007dc04f111c80cab3f90910ebbf5da4eb41aba64d831b1a3b3f50f359fa761384f51
-
SSDEEP
3072:zvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:r1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d20eef1be2ab2ceab4034c82bda17fc064c34bc293533c5264bfef1e58bb5c1f.exe"C:\Users\Admin\AppData\Local\Temp\d20eef1be2ab2ceab4034c82bda17fc064c34bc293533c5264bfef1e58bb5c1f.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5974c67001b580e5355560521d848a3e2
SHA189f57e0ed1397e834cce1c1fc3298f090a8e4209
SHA25680486f48b40bc764e976a366cb1ad7dd2b74024f2dc66bed4da6606932cd00f3
SHA512d76271a57b8466cc84910576179930149a9fb4c717c0981d56f62fafcebb4118e2fd525e564a8431515b7a25644eb39e4439adad137c435e9dcad155187d9aa1
-
Filesize
42KB
MD52fe5ee0ffe7fb77726141090aae02f45
SHA15c7dac4d657ec0207318fc70eba1bed8131918ee
SHA256d0a5a35efb6806636603d676ba1d6fff721c6bd2406be16d9f7f1b8dcc259314
SHA512d596fb527193e4d5c8b875bc4838a007f616d7e28533a317eadf7ad0b6c5eab878e58a888de04c777bce85367cb900c0cf97ab4bdd9c34716cc6f1d842d2921d
-
Filesize
42KB
MD536b8e71019bc03afdb80bb92b54b1bb5
SHA1fff2f051d1efef14b4b27071524a1eb2c4a881c1
SHA2568aa3dc04f3bbfb059f7acd03b0b0f27c7f8f689c33effd8a2a73586a581fd008
SHA512182ddf4190cf7ce2efcaca2bcc90d0515cde5856dc012d9675c29059b24fc59ddf5e5e64f0edb830cbacecb9ef3f682f725a978b5f4dceba55b464bd37be9685
-
Filesize
218KB
MD5d186fc5d1996b6921b4c5b239b9c693c
SHA1b8c4b0045631f0d880da5cff28a6117542334cca
SHA2569bad65eacdc2253b2903165187e7221b27d03a39f7a81c9ef3adcaa4c2ab91fa
SHA5120d60deafc6e0575e4122c062770b11f351d14c87e9877fadedbffc2e3580c6c784bb59516b610fd8bfa5ba2a75f97348f3fd5341ce1baff41d16d7020a816c80
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB