Analysis
-
max time kernel
111s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/01/2025, 09:26
General
-
Target
308ed72b9383db589d12bbbda21cd2ec8baead48b108c82c5eb3163195469550N.exe
-
Size
208KB
-
MD5
66086ab47339255a7273e80d6acdba20
-
SHA1
b11452b4604e31a77718006680a228e904f39765
-
SHA256
308ed72b9383db589d12bbbda21cd2ec8baead48b108c82c5eb3163195469550
-
SHA512
a099011738f0412c0159b0e78944ee885ca1cc7dd1b2abf6b6349227be83eef27d0e460d902d4c54031559835c9ae90083d53980f18d28bd202604d93344a9f1
-
SSDEEP
6144:Ga1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkw:GbapK0JCmRcU9vVokfD
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\308ed72b9383db589d12bbbda21cd2ec8baead48b108c82c5eb3163195469550N.exe"C:\Users\Admin\AppData\Local\Temp\308ed72b9383db589d12bbbda21cd2ec8baead48b108c82c5eb3163195469550N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD505802c2be7af20fc65e0e856473a2672
SHA1f7c8bae9415db223ee14154dc9a1bd2c68e74d74
SHA2564cc7ce5f5ebd6f9c9a321e916755dcfe20c35e3b9796577e43d8fc678ae3ca2c
SHA51290a21e05c1519b1dabf2690eb042891902e4b42807742908776d785899c3f3968d0b518fa66ae5343990f48e2f5fa19ec537137d7fa7ae218bda43932808c48b
-
Filesize
208KB
MD54cb78449b46205215c0f384c331ae480
SHA13bcab2efa7538f60cb11dcfdd91e391edfde5caa
SHA256e5559186bcbdd0bbe1f0104df5d79c044361dad8fb00221e62cf51360e46197c
SHA5124f5919cb1f93780f06d0bdc7400a2b5f1b7dd610ccc03075b6d8f30127ff80c31b4677c053fefe19e2d0a9a0a0c003e603ef3f0e073ceb461a0bd00569482c5c
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
412KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB