Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05/02/2025, 03:30
General
-
Target
b81f85a622e2a251f8b9207f9fabc1c0fe3f7946feee047bb7aafef7a9c89d4b.exe
-
Size
218KB
-
MD5
451d415999e3ff20939437223dd858f2
-
SHA1
1317e9f20a1f43462c6eca78394ec2db562ebdfe
-
SHA256
b81f85a622e2a251f8b9207f9fabc1c0fe3f7946feee047bb7aafef7a9c89d4b
-
SHA512
23d7a8a3de57e2f499afd1897aa07cbee2b0c42fde19aa30e9c87625c3fe31caa4377f39cb09c16e014ba87843b2bdffc6a951a945f1ba704858b540e886d84a
-
SSDEEP
3072:hvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:l1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b81f85a622e2a251f8b9207f9fabc1c0fe3f7946feee047bb7aafef7a9c89d4b.exe"C:\Users\Admin\AppData\Local\Temp\b81f85a622e2a251f8b9207f9fabc1c0fe3f7946feee047bb7aafef7a9c89d4b.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD596f07d6069937de769f1d84d1305902f
SHA17b3b29f13604cb3263f1bfe6e151a26ffe82e63a
SHA256dc23d69a979400a42ba88a203da1852135f8161134e037910a707c23b69deee1
SHA512b458ce6db074981c7bfa97054d476745a4cc5e9f2f5d51a769beafefba2fd3df16886701d11078002e8e4932cc7d6b25e9f628b218ef4862edcfec39f63046c8
-
Filesize
41KB
MD5b5be260c328a5920f292fa36411db5be
SHA15aa8cdea6d50dec6627778ce8d2d767d2b6bfbf1
SHA256095fcf724d840fa0f148714f7c48d6245e438c55313d150c95e28796c415297c
SHA5124b990101ba2e681e6113e45e557b643515f8b8155330bb41fdde3126d58c74b7202225db0ba8320db6a61137a83edbbe63b9a7756ddc32dcc0671e0fef8c4ed0
-
Filesize
218KB
MD531096709fb5799c23fdfce972f787a14
SHA197f66108d216e849490787d15dcff8bf82c249ab
SHA256db5ab6018ee261cdc0c0c0371776be5d5a3927288b98b08dafc73f093a2d7374
SHA5127ab73c89788864147b1cf77e5aff9a2f1c44ccc31b0a59104815cf0e7633f61489aa2e4a35653af1060b47dc879d0b9a6ff3c0ff71868f474efafe5fb05f193a
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB