Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
07-02-2025 00:55
General
-
Target
67ec6260b3a2e84ee17a10c60af217a5381d13500c2176b5253828bc5d1c3e93.exe
-
Size
217KB
-
MD5
0e7ca7549dc89a63bab740df523a559c
-
SHA1
d333be86a9c116792b21dcb7846cd956361cdd09
-
SHA256
67ec6260b3a2e84ee17a10c60af217a5381d13500c2176b5253828bc5d1c3e93
-
SHA512
bb4af72a8efe5d69e82893dab0da42395091fe8da0379b81dc98c6da866b6756629125b94303d3c2dc6989ba1c8dc46a98345ef6e88074ddf411312bdda39be6
-
SSDEEP
6144:6rRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:AsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\67ec6260b3a2e84ee17a10c60af217a5381d13500c2176b5253828bc5d1c3e93.exe"C:\Users\Admin\AppData\Local\Temp\67ec6260b3a2e84ee17a10c60af217a5381d13500c2176b5253828bc5d1c3e93.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD51108da98f62781a14b5b3d8a10bef5a4
SHA15cf2d59b94b7f24cd895de2b0355b29f1694085a
SHA25666a6074c4a4c7acabf313a65f170bbbf1ece0cf15522852be3546149abea93d1
SHA5127873c5e77bf95c30944683dfb990092fab69e9511f2af0bab7e04f7eac3579034c9eb4adc4b443b4db28ddb4fc5f975da61000cccf34d6d87123a48c6fed84ef
-
Filesize
217KB
MD58d741ad58e03f4cd333324c126d81d89
SHA151779e5bc5ceff348e0b9fae94c19711e4983a67
SHA25682e2b7ac09151e148a2f09e4efb5fadda37422cd4375623227331446bda5fb17
SHA512492f336180121216a89c3389c8d4e01a721c2b4bc545fa940a810d62a68bdcc182f44e210e66b323f70d7afdbf92af00fa56ec1999d6b2acb80d479961218659
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB