Analysis
-
max time kernel
111s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-01-2025 21:28
General
-
Target
923303698f5f8165e12fbd7659a9cbf780cf20e227b9e0b10711772600631048.exe
-
Size
218KB
-
MD5
c07609e5a7d7aab312671f74585e61e9
-
SHA1
72744de09530912879cd6e75666c4b18ea5ac3dc
-
SHA256
923303698f5f8165e12fbd7659a9cbf780cf20e227b9e0b10711772600631048
-
SHA512
b87c2b32a3fec43b548f9cd547af3479c0c0adaa1b57e11207378655e49ff4cd2b716a8712e5fb966455133c6e260dec0dd0ec6215ba94f95e9e2064dba92ed5
-
SSDEEP
6144:YEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICy:YEGDdQNHEwWlMxYG/wIT
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\923303698f5f8165e12fbd7659a9cbf780cf20e227b9e0b10711772600631048.exe"C:\Users\Admin\AppData\Local\Temp\923303698f5f8165e12fbd7659a9cbf780cf20e227b9e0b10711772600631048.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5e2e54f25c4c3d5577cb0a8247cd0ecb6
SHA10380455c2898ef05135d5b067e96c89068589580
SHA256629075e859b03fcd21a60df090d16844e2d57985319905473353a9431ad173db
SHA5120b74374962ec919ba9cd25dbae514ed99f4a8e06901ac87a55a9abac039ef4c44d5bbe3de45db6726363d9abeb3ac8375d56797752165bc5dfd70cb1ede33c37
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD591d1b7ff9c365c850dfc7f16d9aee22b
SHA1b389686c85480c0dd4086176535f229ca62e629d
SHA2560986c6ee81a34a1c706f9f42d6e22df0094fc7b7da51bb919d1ce1d66892d5a6
SHA512269b0c625782d72fdfb0900d42eac4380d05063e138fa2d760da36883b3199eb6a9c027f8b9439a65a7e92debdb0b56fbef32478a178687dd0a5971b54c07c52
-
Filesize
218KB
MD5ff1dc88997eb7c333e19eeeb97bdc3df
SHA17b1f0d85c2c01a8ae1d180cf0472297c2bb26214
SHA2565288e656022917903d9ec5eeb72bb6fd9c8896d06a853551526853bd6905fa06
SHA512be40e60cebb6511ac336e563f037ee2ea355392a71cda6ffa993ac51f9ac124fd2e7f03b102b405f1abd612bd1e7f462fb221382f54d440ec328ecc2e2772353
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB