Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
20/02/2025, 09:57
General
-
Target
f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1.exe
-
Size
217KB
-
MD5
1af2c59cc3845e37288c679574c541a8
-
SHA1
a06bc23d1062217467df4a054db91c55039dbd80
-
SHA256
f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1
-
SHA512
350e75f5936d69e8e00368e37aba153c7dbadc89158b33e18b0cc3b9f431804f84e8b295744a949e1d4aa8cd49f6e551c0ec40027972018f84a04a4eca70b898
-
SSDEEP
6144:irRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:IsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1.exe"C:\Users\Admin\AppData\Local\Temp\f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
2KB
MD595f2490e80f5fb53a164d5b25338f367
SHA1d24ddc67d3a4b1eb94f93529d7e40087558e6868
SHA256c53295ec03bf1daa164722de8bef8d4ca8957c07944ebf93d4845e064ba2682a
SHA5123b0f425fc8ff36fef6cb3557a525ee6b1e69cab8062f1fd6676926accdffd5283f7d9f0aa8afab87f1530b68b6d3612e1ff90737dbe8f05d94cdb42f198c0c55
-
Filesize
481B
MD535d0d078c6a518e4de3eb0137e1836d2
SHA1623dd9e4355fe85bbb7d5579e43d1c6df579eb3e
SHA256a414c338bb109d95904cfc1de770877a7e21bb2a206f13d20df3e0f871c16b78
SHA512c3ba2bf0668ca754e74b2f1b7ad1e9a6fc6154859749c87b69fde95880b9fe88a14012d80d0dbc60088496f3de9c02224d2240c435d9f895b9285009310491a4
-
Filesize
481B
MD56d77ae9c3f6b6a41f70fc817669cf14c
SHA1f1a9c07b0763992de464cdb8a18496623ed6e742
SHA25613664f3822bce332244d7c37f1686ceada3600523883bda58a3532a5554a7834
SHA512c8fa0f2d4dda2b133749326fe2375e944ba7f0c20d7bedec91e4a35ecf8e1fb61568a93b328061f224160238ac690841643d41139c7343fef1573999014f5059
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD503ac3cfc01132e7addf9ac25441caccc
SHA167a4ef9a7950d1d7269c8b15388cbf1a8cffedb5
SHA2564592ba09a9da2d8b9562968139f6dab791f00777c9a814523eb44a2fb9eb602c
SHA5124a1e562a6e9e1eecd6f75e5b7423d51536c0b7ea6ecc5b8016f556edf3cc1e82c1c60b7e25ee8ee1d25f337e7ba1844c882cd4e8b3bfc52bac4d83e4a1279e4a
-
Filesize
217KB
MD5747019aceb7b1a84e0333bae16e350f2
SHA1050f73784010c815baf08ee929345fc5919af4a2
SHA2569f0724cfad4e8764ddfd0826227364d75e9b91979f82b7b3fff5f9ca115a3517
SHA512c66489925ab47f68324dc94a79862c544dc287c0da526c1b6508a01eef191d9a9ae8050f52e0866e99131a296985f9347f6df26cf851c2e72dddb2245ef54b73
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB