Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
22/02/2025, 02:35
General
-
Target
7487b4b9a07a4b63acbfd0015b07ce31e4beb71bc32ea1b897e3340b7de47247.exe
-
Size
686KB
-
MD5
cc84196d1c33109852dfa7a808cf7191
-
SHA1
1010f9d133fbbec51c48299a1cf23a7467cb6786
-
SHA256
7487b4b9a07a4b63acbfd0015b07ce31e4beb71bc32ea1b897e3340b7de47247
-
SHA512
7a2af8814c688d8087364d4928df3c8c055a389d55c9a3ed0e1e29e950e7cb4f89a41620c418c79c30335cc8f6cd30f34b122c1ed54d6e95d8f5e4aeccd19ca1
-
SSDEEP
12288:dmWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgp:dmUNJyJqb1FcMap2ATT5itjCYZ3DSo
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7487b4b9a07a4b63acbfd0015b07ce31e4beb71bc32ea1b897e3340b7de47247.exe"C:\Users\Admin\AppData\Local\Temp\7487b4b9a07a4b63acbfd0015b07ce31e4beb71bc32ea1b897e3340b7de47247.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD50ba45b388d7761c0c1f894af6a45f6f0
SHA159e245c3be4f50adea78b00b792a9009455c0025
SHA256503a70fcdf3f05184c9bfd61ce1bf42214f2c5d56bf4077dbc06a427b1bb24e4
SHA512108ecfbf6c79425d0bbe31a717900edd5b0038809130b6c57b644c00708f39f2394a80efe5480124f89a1414511c062e752c8bb45f4753110997b9b8c33b5610
-
Filesize
481B
MD5807918c9021dd576d166a388d22a51e0
SHA154260efd64962e97eaf676d9c475930d8bdf0977
SHA256444d895e41bc576a731af76c70f188bd8a64f50e939bc0f4ab4782611ff953b6
SHA512ea9d7e3a44e221e8ee1a7900c9fc1cdc650a6dc4916467718d9e78791b24b5283ad062ecf81710b76233bae696b4a15acad63bd76d5f0d330a1bd920f9ffc0a5
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
686KB
MD5100d263c3f9db2817078d31fe6a007cf
SHA17a25387829a792b15304476c322bcfb774d69bb7
SHA256ae3b1af2a3357cff897a0a9364970e16618dba71766233c87edd4b1449ced283
SHA512b6a1f0a457b8e2c23268ec45843d08635e453e36baa155272be4f047d820f40d0a8f9fcc79ac06982fffc50fde1b329f67e9a5dc6d8e484cc418f3e5c14f770f
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB