Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
05/02/2025, 02:43
General
-
Target
35037b09be6a1cb1fb97ab659c9ed781d89700412f8aef9456762d65cdc981a8N.exe
-
Size
218KB
-
MD5
7b72c12dada08552f4e5c7202b73aad0
-
SHA1
7447e28271b2c0e0739171c6bafeec6d7a4538b6
-
SHA256
35037b09be6a1cb1fb97ab659c9ed781d89700412f8aef9456762d65cdc981a8
-
SHA512
fbbc2d5317edd9e70c696fc9d285842412121551b174095a6db18d73a7969d2f0137b84b2aaff6c05cdb203f820ab02d5824d201a5c7654adf1852fec1377aff
-
SSDEEP
3072:bvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:j1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\35037b09be6a1cb1fb97ab659c9ed781d89700412f8aef9456762d65cdc981a8N.exe"C:\Users\Admin\AppData\Local\Temp\35037b09be6a1cb1fb97ab659c9ed781d89700412f8aef9456762d65cdc981a8N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
61KB
MD5dbb758b09cc5747a1273e53e20f57650
SHA18430b52b80572afb7cd482696b9f714e2f5d3e14
SHA256b54c24c202b841e931cb8c30f5d6c0b74389cf105030c710d749694c280b4c6b
SHA512650ec358809495b811b60b36eb33cb55f6b40de020b7258bf69ff44f5c2e25ff9f3a2c3e41c9b53a3b1f9d2f06ceba49689c2453d7a9c1bf6d5ccda6591bcdcd
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5af383dc5ff44cbc94632cfb1e174c53a
SHA1a155641f4cb674a731eea6dae820d8300841ffde
SHA256092e1dd375a51f7dfcb84056c6025b791c00ab1f82be113a211316b552cfb8ee
SHA5126635558f043ddb0905998254070fa6c830dbbf6b586253599e58c6fbbbe653bd18397f88926f42737c7b1d3e717c96d752d28909fb2a09751e5acd5d67405c16
-
Filesize
100KB
MD52adc3855a1b60824f3d7bc646a1bf2ff
SHA18418627a0f1dd3d3899c71cbc59034463a747068
SHA25679520182a492fec0dff1fe7d185061079973786a699372be431ffaa378cb8754
SHA512ed75e2e1c14c342bbd7b89e4e3cc093a9b6cbfc10ef57b1bac52a18082631fce4bca7d99f23ebd82cb6f427a85e538bf42eb3c856ea3d768ff5ae9c4c83757d5
-
Filesize
64KB
MD5c604564e95017f79589976de2bcb37d2
SHA141a1309c17389ef34adc8cd21b9b9e8d33ece168
SHA2568320ae0126e81e2ed950059101b27bc33da3f79eac97f61a7f7a9c2e019592b1
SHA512bfd603ce400502d471f2a32b17f39b18801c2bb4fec5bcffc7d0f7d3e8f5ffa7e880e374571ce9ea92f91bd130721699de8e8d8885340f8dcdd595dff68f791a
-
Filesize
24KB
MD55f645362779a7bb2abf3edd6d316b7c3
SHA13e33df6fd75c8297a748826bc8307948280a11c1
SHA256f517a5b0c85725917230ed5bd70b9402810eeb09fb30e470dd5ed3e0c0ca16c4
SHA512c2db7352083a469141a0263a0f8152f24ae06d08b3634bccae59925e64c6ea71b18efd7c8bd50b218d74e2cc7439649447ecd7d3e1eeea597c52f90ec88b0c58
-
Filesize
218KB
MD52c9889f533d3d3c6bfa047d89b6d491e
SHA110e6788715ad6fb0a138717aad4db6e3e6700f6c
SHA25629147992b06308e6fcdea30a2b81fa770db16e23c2ad655c41492d7ec01b1df2
SHA5126cf2e05a2b147b7838e2decdf7f961d90c06343f38660fa9a0d8881cf4c02642c4f8afcfca219e99b782049af3a28fad87b391330408d8a46f89d8807282dca5
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB