Analysis
-
max time kernel
114s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-01-2025 02:36
General
-
Target
9f932829cdb68f73a607b55df40a892c4a53872d7e638e7869ddae3488edc243N.exe
-
Size
218KB
-
MD5
f08b6ea5326e4b468f7058f98c05a630
-
SHA1
5bd002d6008cb1bbd2655a09b347845d702561f8
-
SHA256
9f932829cdb68f73a607b55df40a892c4a53872d7e638e7869ddae3488edc243
-
SHA512
3c81788f72b628e6d26023e0456c7a2c75f9e4af5f6e63edd55c9f89237586dc6c6228b99cd3d1f5b7ab06c4af6c0692709ca1d3ba7cd0305e3f79cc75bc060e
-
SSDEEP
6144:GEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:GEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f932829cdb68f73a607b55df40a892c4a53872d7e638e7869ddae3488edc243N.exe"C:\Users\Admin\AppData\Local\Temp\9f932829cdb68f73a607b55df40a892c4a53872d7e638e7869ddae3488edc243N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5ff1086050d885981e17ff72a760453bb
SHA119f29f9c875ceb5685f839122fe7883349f3a0b4
SHA256d6deb6612ec4533304c0a502997b4ce7593c32d54721e23fd910d0ff4941f2e2
SHA5129476a23e24989a29c05ea0e876a52a748d422e17a5d1a29861490a521904dc4ab7a94106a0393fd50415db94008c5bdfbd3d18ae15810ee59bde20659f694af6
-
Filesize
218KB
MD5fe20f070c63099d148f7fea3872d5390
SHA162527f4d37fa5dc5d4336f616ad817fc50085a70
SHA2560dbc11766697d4a8f9ac85951a3f9fd41aecd9de7dfcb466b481c8f885e959fc
SHA512ef95d050ac19fd0b90df080f0e03fa14d3610885de677aec8e38f3186a4c92399932e9ec78523a788ac5d4761fa654fc95d57227d0df120115bf96db2f2cd1d2
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB