Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
20/02/2025, 10:00
General
-
Target
f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1.exe
-
Size
217KB
-
MD5
1af2c59cc3845e37288c679574c541a8
-
SHA1
a06bc23d1062217467df4a054db91c55039dbd80
-
SHA256
f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1
-
SHA512
350e75f5936d69e8e00368e37aba153c7dbadc89158b33e18b0cc3b9f431804f84e8b295744a949e1d4aa8cd49f6e551c0ec40027972018f84a04a4eca70b898
-
SSDEEP
6144:irRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:IsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1.exe"C:\Users\Admin\AppData\Local\Temp\f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
42KB
MD501f1b5b52c337c20acdbdc4670818882
SHA1282eb8b08877f4f4fb22c4cce9110fe1fd61fb7d
SHA256289dde892e60fb5a02018f7ca26a70ea3be3bd2e137d2e2bf15b547e99a1d45d
SHA51239b60f8e83f67cbcf67d94bfdebef5a7985c70d4fdadd8b57f9c0ed95377d78a20e307fe9d28533b1e1ab43c9544028e52143d7f4790bfe9f77f6b100d54b38f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5d9a0fc441b8064359c153cbb17b242c6
SHA16ebc12de0b88752c66e998e32d326f215b21173e
SHA2567458b33619464c2fff51f15ac1d82334f350c104ec3e20de657a3aa6565cde50
SHA512c92c5aae6d9feedd446595b074a1183cf45b207b823b3a3344f1e2c656244b2047e36c533abf551eb427b2bd89ba1b174cdcd35b2c2230795424c3abbdda349f
-
Filesize
2KB
MD5d3ba48b2c3c83c69b187c032f65fefb1
SHA1fc436f6ac36fbf26c31a57fd0c81fed03ec7d21b
SHA256419cf45124d1047e1881e8ac2320fef9b8411a17f8d0e33559396d8d85f3faeb
SHA5122f41fdef6a9afe7ad83b12f20f5efaf9b42f6e7eb41848483f37bb12012be464cc8e6e26c9a37cccd64f6b11ab56d96c725a19cbeafc36de110b59b1e7b351a7
-
Filesize
481B
MD522857322d06235019deac8aac8c9b6b2
SHA138786d54f582352304ed07b16a43b6c338e3bdbe
SHA2566ada9717d4a67fdc0dd550a183801f6d6a8843f76c1d7521b00a1911881601f3
SHA512f791f16b4cc1006cd36b7f7e18a355ebe1144a3060a978f30c144d35b5896ec26eae6abb460e65f849ef0489a2f70560a68aba70f376ad79e374ef7873b7852f
-
Filesize
217KB
MD56e958104e5370a1961e7d84405f3487e
SHA1525b03b6252a5431cf49a38c45a77afa81766b3e
SHA256106e48fc76620b4d46e3136480376f565c0923862af32f07988a324ee18f1e93
SHA512b94fdd36f2205c3d57fe5a8219b78f6e8c7ffeb7d54c37bcb6135ddb7bdb0142e9156c0b53461d59e9a270b4ee7c28172e4b46c730528db0142901fe09cee13c
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB