Analysis
-
max time kernel
111s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-01-2025 23:23
General
-
Target
d07e8385c4ad8594e315a38f4c06660b66b4b3500101cf48d33d243c9248c7f6N.exe
-
Size
218KB
-
MD5
0d10e6d27a671722e7d2e15d1731a5d0
-
SHA1
b7e4c5354a8a673d12dccaad98d66d3f138319b6
-
SHA256
d07e8385c4ad8594e315a38f4c06660b66b4b3500101cf48d33d243c9248c7f6
-
SHA512
a11b16e2c723f0854d6c1486f21ae701683b7d5b77766b525e7a31ed4c0604ee83c5ec8c285ba91fb739061d9b61c76475eb23c08433b16378c4d1b231ad5d03
-
SSDEEP
3072:/vm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:X1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d07e8385c4ad8594e315a38f4c06660b66b4b3500101cf48d33d243c9248c7f6N.exe"C:\Users\Admin\AppData\Local\Temp\d07e8385c4ad8594e315a38f4c06660b66b4b3500101cf48d33d243c9248c7f6N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5ce29fdda3f4bd7e1042100a633b25efe
SHA16c3378100b308a57c762f2769995650bd9b8b0b3
SHA2561c3058a0d7cd1a67fb537cca0237651aa92adb1c7fd95b802f55a1126e811869
SHA512c95dca1666660b8fab4dd67ec86344444dc5ff7bb03cd04bd2891fad78edc90fa9b5c3107c8ee618980da6eef469b9b2b45b1ef43655541e8346f9a6e4eccc25
-
Filesize
42KB
MD504c8fd972a580f1918f0563cf8694859
SHA1b286870f69310721eb32bdb8ad51d5ac9212ffaf
SHA2562164d25d5bf9bdc983d99f7b1886d3368872f641ae783b0c714bce4fca6ee6e1
SHA512c9d96de2379a54593bc8ad18288693d5169366e7e2e33f92deafec0ca24ed4a9bacd42f1774527681f39f62aa3c22ee110ea6ba43db20a13e301343ab2ce303a
-
Filesize
42KB
MD5ab418dd6d4072abc9ec0e2c148ea23b2
SHA17d75700d40feddb6c9cc17ee2ac6d69d494f04b5
SHA25659703975bd45a0f954df9f6e498e01bae6e2e6841d0e06ad6d7f8cd801271a4e
SHA512b3a6bd2bf643754de6b21b904ecb305bd740dd31be0e4fde186ea18a160d411bdd8d95cc5c8a5e7494a09b06f664f9e074ea087da1fb417798e6837ab3f21b04
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
218KB
MD5ba7fe0143e75aaf6d88d15de5e43394a
SHA1574b1d139fae8ebcf0b65d25292e0b9f5967aefe
SHA2569b2d86d130bf96e763c4afd3c900935b55de0b0729d7d4605078fe83c26259c3
SHA512d60623b13434cf7ea38e3bc08e99d8786519f39035b447e025642d02678e6f063b6920028b58d866806191f780c4c8665d828a304ee28ce99ae1daf907a52d02
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB