Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-01-2025 11:19
General
-
Target
d77e183a60b3e5cb2740d613f0da067d9716dfb579befaff6cddd3396d857c02.exe
-
Size
208KB
-
MD5
24dda74609da40cad836f40c24e702ea
-
SHA1
2b9d015cf43901087746f0dbd16908b163034cb3
-
SHA256
d77e183a60b3e5cb2740d613f0da067d9716dfb579befaff6cddd3396d857c02
-
SHA512
56cb09be794533d893f7fc157a5a91fb683e994a67b4b05da8ac441746b49451393305aa02b487668b18a90dec631cfa0ab3dc0daef425b8bd20a763c6bbb92c
-
SSDEEP
6144:HZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5a:5quCuygMQjd5vJIBP15
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 9 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d77e183a60b3e5cb2740d613f0da067d9716dfb579befaff6cddd3396d857c02.exe"C:\Users\Admin\AppData\Local\Temp\d77e183a60b3e5cb2740d613f0da067d9716dfb579befaff6cddd3396d857c02.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD5252c36ca5fa8820b3d1d43bda4d41b62
SHA132d1cc80f957d389219f6b33954f80889ba4f38d
SHA256f1a1ce3fe85ac41e8809691a0e8ea99a3d4d33b0c992e4daa5f37fcef9f24405
SHA512b2328b06662ed66708b3dbd6722bc6a49b10009ab22c1f5e3f40134f8c89f087b5a93fa7e12d317c155298bafc3e38c38cc692036ab876262ab05557afea246c
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
564KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
564KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
564KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
564KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
328KB
-
Filesize
564KB
-
Filesize
380KB
-
Filesize
564KB
-
Filesize
380KB
-
Filesize
328KB