Analysis
-
max time kernel
107s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-01-2025 11:03
General
-
Target
d456733293e64b677afd208caed26c9ecaf40cccf9975148dc6feb9128c2d809.exe
-
Size
375KB
-
MD5
5ff7fa082feec4f410a3ddb2557af878
-
SHA1
35391d094a2fc3ad8804707148d93fc379687b1c
-
SHA256
d456733293e64b677afd208caed26c9ecaf40cccf9975148dc6feb9128c2d809
-
SHA512
5c5fbb32c570722c4cc5468bd883989251ecec1269522ab1607a0dc632aa8396ffe268c3a54d8bb38900f833d1715c7d0eac05a705bb447f296a2ef33c278de1
-
SSDEEP
6144:Y3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:jmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d456733293e64b677afd208caed26c9ecaf40cccf9975148dc6feb9128c2d809.exe"C:\Users\Admin\AppData\Local\Temp\d456733293e64b677afd208caed26c9ecaf40cccf9975148dc6feb9128c2d809.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5293a7783f3da1f543fe04e4d5ccd6431
SHA179673ff5296dc33fd633a23e454629be159e295a
SHA2569d26366f7ec079500707bb0232449aa7705c18ea1760d96e8eff0953d376270a
SHA512d6ff85ada5588ee544ca859254f6f74a76a91d613b3309e32b696cb666749186a1858752b0c24fb28a125e54b9f7f5f1d18e0f7229eac6f7babe8acbb8b9eb68
-
Filesize
24KB
MD531474e22b45053765b30a1169c2bdbc7
SHA125840c647860e61fb8c1d7ae63d947005ab82a71
SHA256190c71e10f1ea4f008a65c3bfc97d6b8d61645784795aa92956b5a786df0e776
SHA51291e8a3d887637da61c6a377706501d045915805ee1fea054e7edd0e3b880220ec51353153c4d6b98af81b1fe166d1a8816389e63af7bf0b18566314c1aeb9171
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
375KB
MD5f4b934abeb2289ade56b78fbcb748bb2
SHA1cd9d0e6690ef58dc12500cfe042efaca31671737
SHA256f8d3427f0828979a0ff4497ed604dc1cfe9ccf466bfcd55d5bf47944a1c118ea
SHA51294838d65525a39ea90f3a59c90dfa2406f1d5b918cfa8b3f96a17494963f4b3016876f7cb6aa1366adc62084d0859d325e3a4bd46bece97ad2fcef62f5a6a45d
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
672KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB