Analysis
-
max time kernel
115s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
05/02/2025, 05:40
General
-
Target
d21b8f4b056bd1c54a1b93094f09062dbbb861bbe593e29fd623c4ad6028303bN.exe
-
Size
218KB
-
MD5
353fa7deefd476a5ef1c1f92dbc1e050
-
SHA1
80f3f70e9ffb74dacd8d0494854379664a84c9a5
-
SHA256
d21b8f4b056bd1c54a1b93094f09062dbbb861bbe593e29fd623c4ad6028303b
-
SHA512
b6cc92d583da18246b75630e97a1b26329b1f8c1444a05b99447ba0aaaf2811e55a9dbf9c9464307e2deaba5cd32e0910c7862e5b5915c575504262bec5c04b3
-
SSDEEP
3072:Jvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:d1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d21b8f4b056bd1c54a1b93094f09062dbbb861bbe593e29fd623c4ad6028303bN.exe"C:\Users\Admin\AppData\Local\Temp\d21b8f4b056bd1c54a1b93094f09062dbbb861bbe593e29fd623c4ad6028303bN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
61KB
MD54c377e07edb1dcf88c3428fe95768b3e
SHA189427bd57caba8ff8b1cf203c6356eaf1884de9c
SHA2569be007ec2324a62d3c23b0b7c73a2ea72a57bc7bb7a50ef2ff39c82ff93664f6
SHA5122b01e88c02190ad0e45d57e8453b7c102931f1ffd7196150ca53eec17d7d6d0985b94a057adad778a32c6740433a2c9a9e0695f5ce5ed0d25d8db8981d04cdf0
-
Filesize
41KB
MD54bd663417d1e702ac1e1221bd3fc0032
SHA1b8a9c50a81c29e235bef51c84ed3d32f815bb182
SHA256d5d090524274bb4a90a7964a0d7607e7aecd6e6399bd38c130cb6f33e77b571e
SHA51234123e4b6e6bee7e4cf8836596a6d0a419bfea11567fb9fc3f2efb099ea00d22a2a1964e9c7e2f5a82063974643985bafd2db1e2b6f80f824668f85552a0fe4c
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD539b77806110a4887f27e5027336f1342
SHA1131f94f0eafa39cc0ba824afcd698c5f9aaab555
SHA25680e44104189ae5572a3bb3143d7b4e00a7779ca69f3f2cbc513fbc9ed0ff7804
SHA5121cd29d6e0d933ba3ea88082c144cbe5e2a4463b053eb5ac89a7a198ca818e1e1dc3f001d54a4f5021a41625451b9acfed789a1ee290391c628bfea339507081b
-
Filesize
218KB
MD563bcfaf510aa70176d1bca0111330ac6
SHA134a05eecd2b99443fa832863d8b64c737500575f
SHA2565c0536fc66563db869aa43922b6e90b49d473f01618611d4a0760141393017f4
SHA512e64e34bc3ef818c99dbf6caedc1adb3218901f651788a5b78e2b7dc428dcd11b5f0eac93ed7c94bbd82954bd6ff0008c281038edf978811b19a09af8f7b48b7d
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB