Analysis
-
max time kernel
111s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-01-2025 14:49
General
-
Target
2b663d06726789a03433b9e41efd064296843b1dfbdcd95b40e22790cd444fcc.exe
-
Size
218KB
-
MD5
1af7f020cada60e0ec19a0cf66eef310
-
SHA1
0850a5b48715d57f80f57a088819246ff9b0b58d
-
SHA256
2b663d06726789a03433b9e41efd064296843b1dfbdcd95b40e22790cd444fcc
-
SHA512
3395e98e5aacffef2cf5a6e13aecf6aa58a85ae2355dad4bc227011c45cd30195c78d2f3975eb5ddb695f811f0a0e9a62d45fb6ea8d680b578588b93f363b504
-
SSDEEP
3072:Tvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2HO:L1SyAJp6rjn1gOObn4b6h9b
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b663d06726789a03433b9e41efd064296843b1dfbdcd95b40e22790cd444fcc.exe"C:\Users\Admin\AppData\Local\Temp\2b663d06726789a03433b9e41efd064296843b1dfbdcd95b40e22790cd444fcc.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD566e1377a5a7b09c53d39b65ead55c2ec
SHA1396b480a7901f998eec1810bbfd12edfb12c831a
SHA256c0d2be939593dd02f458340c09bf85765ca7bf2c0982e11f3917841d82300bf3
SHA51201c75a3b6ce83926fab4f3651600c7d69ca1f7308dec71994522b32c1549dc176a142ead24966992aec11143885233fbf08dffce077ce9d70263dabb9e8a5631
-
Filesize
24KB
MD591e6c6ac91e86f4f392cbb4bbf461ffe
SHA1ba872c355136fbf201ff0298f4b07d30e9da7212
SHA2561f580cfc6546794277036987990aa12a66893802fec2337943a2d82090887992
SHA512702a07c1d532aca5bb7b8d689caa9212c7b4fbd3203f4b0a933a0b85e9e81152f468c5a78282756d113cd14b26c59492fb9d9d590ab581ebae37e0b50e79942b
-
Filesize
218KB
MD5219689c85709bced2aa08043e3840ddd
SHA1921c61832c55a3681192860b698f03d37ea67524
SHA256b398b49eecee5f920f061ea1ceeec054ae8e331d50dcc400b0f361ec35f77e63
SHA512575907f807c910a307a083e484771c971b6e9fdeaf11a3b83c4dee1569320608b0f0c8c041176e94a8405186d93e2b889d8c81953abc7df97d68f67c82a5b4f8
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB