Analysis
-
max time kernel
111s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/01/2025, 16:26
General
-
Target
c6fa74e2468e9f277eab1c0478e16ef924fadfbfcbab3adf1dd075c33fde93cfN.exe
-
Size
218KB
-
MD5
112ec944ca7b2d8f8d2bc95f62ae3770
-
SHA1
6ebd45a9a49ec91457776f18d732943cd3a1a5f0
-
SHA256
c6fa74e2468e9f277eab1c0478e16ef924fadfbfcbab3adf1dd075c33fde93cf
-
SHA512
4992dfdb88bb83300c8a61a5d61666484f4287080b10da192818024438ece39d41ae644f7d411da1158a97fc003667ddd2d30509366dae9fa1fc52e6f8617118
-
SSDEEP
3072:evm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:g1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6fa74e2468e9f277eab1c0478e16ef924fadfbfcbab3adf1dd075c33fde93cfN.exe"C:\Users\Admin\AppData\Local\Temp\c6fa74e2468e9f277eab1c0478e16ef924fadfbfcbab3adf1dd075c33fde93cfN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
24KB
MD5b2c468d90bb63dacb66d07edabe136fa
SHA104f4e270510e7c6a0b2d679a61b81f8dd1190010
SHA256600f75f93e86a274d08b5c2d68fb0f6eceddcd474de39a936fd2f775eaf7c989
SHA512f8a09caf4b9512e2aa0825852b35d42d856f9da0cb679cb3fe1285bc5329e4ad3192d43eb33e5bebae10afaaa342d68aa3285177dc0fbc9ba9c2a8517307599e
-
Filesize
61KB
MD5033c5afbaffa29f13587a3e3fe624cef
SHA18831286cc5ddffa70f0741e4d8b5bace772b7d32
SHA256b030459b1499b5fafc132c2e74e41b248da526e0f614a9517b6436dc0a8f52c9
SHA5121afa0937e4298a8795b4c8b1be27833c6724a7fb90abb8c81baa738c014443d6fa679fde3c8793f0da86f2620d7ed772cf23f74ea2004120565e34a22d4e82cb
-
Filesize
24KB
MD59042b5323f8d59202a36a1a3fb20a09c
SHA1ca35c9d4c6e20a2d8b07037062cc05e698651b9a
SHA2564adcdf83abcc6e3e383c08cfe69e77fa5d3fe31d1998d4685b2003952919d31b
SHA5125892994a64fe3c0b86056e383d8cd61843207d1755875bbf42d575a51ba19221491729c7a2795278619d3e4ca2b2574e5336c40106dc701dd8fee59a70c1c359
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
218KB
MD58a19f6b7c2dd88d052811fdec93921e5
SHA1578e71c96290f6b539cca624ca1c1afbfbb29cb2
SHA256e21acd7d98ae7c4a701255016e829277182504cf2642ff1970c431d9a6b89a8f
SHA51246fe515697c8886448dc8c2374bec4768b8f6fa7bc2bf2ab3912c6028f9934468feba5d3ccc42e7b9b560008ea13901280f73139389bccdacc80d034a23f068d
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB