Analysis
-
max time kernel
112s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-01-2025 07:54
General
-
Target
fd67628fc433e78f9157febf852f89580ce3dd5ed68a7622ef5a31291e8b8b7c.exe
-
Size
218KB
-
MD5
d877ce3f82d9065f5a76c7bd4706e358
-
SHA1
1b43873bf7496a874adea3ba29983d8afd833796
-
SHA256
fd67628fc433e78f9157febf852f89580ce3dd5ed68a7622ef5a31291e8b8b7c
-
SHA512
744e3d0b3606eb5db7c6e9e5b2af98a37d73af3eea0bf9920e8ddc9f4099b0cdba4265ab4b234d3d2d596c319e450f8b8cd9dba1757ae5ad5b8f6988647f6c44
-
SSDEEP
3072:dvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Hu:R1SyAJp6rjn1gOObn4b6h9r
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd67628fc433e78f9157febf852f89580ce3dd5ed68a7622ef5a31291e8b8b7c.exe"C:\Users\Admin\AppData\Local\Temp\fd67628fc433e78f9157febf852f89580ce3dd5ed68a7622ef5a31291e8b8b7c.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5f24c8242a0c664906d0152caa1a8e92d
SHA19871d60a44c5c655d603dd7f164599c49d8ed5fe
SHA256c5f21fefd3fd1efa4cbc0c9a2b3db669f8f6b2b05e97d65c83ab7cdfdf2eda8f
SHA5125e8bd1bbffef66df1d49d90207be090cbc23ea34317cf488ec565b201497c1126f947fc4ce5b86033dc53532f926b2827262da5c286950335ab990538a323f0e
-
Filesize
218KB
MD58729de7e72fc0d0bcfd1113d434f2b7f
SHA1525e70e2221c6632e63cd34b1da6bbb2bc914dcd
SHA256898665191531fc83176fb77b12e90ec7c16f24ffb6bf13d6e74205480cb54969
SHA51251ac9ae0ca0dff9518b2f88b52e989f8e56546c6a3b295ef2137cd0a7bff16e7ca57f5e4f8132b4213a8e301fcd4fefd5c219bc0d29b821d685b91f96e3dc934
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB