Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 15:45
General
-
Target
b9b216f8448f5c4aa836eee7456195de4c54ec5956ce00d09156eea3d512cb51N.exe
-
Size
212KB
-
MD5
3bc1a063f3ef546811d22ad0da4318d0
-
SHA1
98fa545e91b37cf2e4692110154a5509349c117c
-
SHA256
b9b216f8448f5c4aa836eee7456195de4c54ec5956ce00d09156eea3d512cb51
-
SHA512
644c01a9751c55ed2ad0fbb9e1f48196b586ea9b1d03deb5bb2f4dbb3d1c76f7ab76fb2d77ad9d4916f5e4a3b3f1c33043e9f5214952e100fcb65ab4930f045b
-
SSDEEP
6144:Qob34ERMS/H7YAVsobrVn5G4E3Hi96mbQzJWFO8Omw4GZ:vboEj/8ASWM4Ki96/zqIKGZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9b216f8448f5c4aa836eee7456195de4c54ec5956ce00d09156eea3d512cb51N.exe"C:\Users\Admin\AppData\Local\Temp\b9b216f8448f5c4aa836eee7456195de4c54ec5956ce00d09156eea3d512cb51N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD52a589fbe0d8922fba72a566ffe8449ea
SHA19b7310e26f42e7a08b05317c1c96cc851a25ad99
SHA2561e601b6c55b1ba9570808f6a82004f2c4925479263c67b056e564da8116c925b
SHA5123b1c82cf9ce70102103005d7e7d52d38ab4cdfb8583f5a9bcd54b7a18c56af60b70a1b1beaf00f6e77a803d90aebcedcbfb7e3ad04209ceb483635a626b96cda
-
Filesize
212KB
MD546f81d773fd5f6e685ed110276d31dd8
SHA15fb69be163e08c25b0fb5621ba262be1091032e6
SHA2562b9f30068cd5613609fcf97877ed9b01b33e7b41010c726b4fa516f853ea2a60
SHA512e7f938ba2ae0bf5ccc106b352e1b03d44e43e3e68e1ec2d02684b938d029b76fdd11ed75e2e0df1b0e992c4624306e95991f440ad2a8ed617214c90dd2f549a0
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB