Analysis
-
max time kernel
111s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/01/2025, 10:22
General
-
Target
6a4448018ad84df8a5aec18ecb26f1155331d29384c42804d282558651f5ecd3N.exe
-
Size
218KB
-
MD5
7e043d781e18dff9f08c46ade0fd6580
-
SHA1
93d89298dec6e1cba06c59bc5a37e61b46f190c3
-
SHA256
6a4448018ad84df8a5aec18ecb26f1155331d29384c42804d282558651f5ecd3
-
SHA512
7b04a0713e343e84975cf52f2759ecf7297336c249f68556f4afe77ea79776e767266b7afc3fcc98cdf1dc4adfb7c11d851e3cc9b17c17130d23171adbee6722
-
SSDEEP
6144:dEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:dEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a4448018ad84df8a5aec18ecb26f1155331d29384c42804d282558651f5ecd3N.exe"C:\Users\Admin\AppData\Local\Temp\6a4448018ad84df8a5aec18ecb26f1155331d29384c42804d282558651f5ecd3N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5e0937dad482905a7600cc750498f29c3
SHA1aa998ea52d8e16e9d2b83efec504a26adf04516b
SHA256480f8ca9977fed2c806b99649590389a2d0660385a5087f92a39ffe5cfcc4c9c
SHA512bddf54d6d541d9dac8d6c5e24130dada0df871896f937cdd3c562db47d07e7cc14048aff10cca6f922a1bb83a909ae9bb1a1ce8e3bbfa3afdef06ea301559dbf
-
Filesize
218KB
MD51f1d6c250db40baa815d0aa362b01989
SHA1a80f98d96677af7a349ce40cb91fa6175ce6b922
SHA256de48d264d569b4da17976c8498c6515d10a09cdfd72e315125528ce81e7dc158
SHA512fa9ca5c1e3cbf0ec5844ffc52ebe9121fcb6c54d75bac7e10a4d65b7a06e4bb24c4fab7bd487f248b2349c097a71945f911dd2bd2fc2b191ca6e80391d25252a
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB