Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
01-01-2025 19:56
General
-
Target
76347603becb96ed56c8516381562074180e76c806b9c794c267b59f60e3f969.exe
-
Size
218KB
-
MD5
5ec045751694383deef7f029aa890288
-
SHA1
bccbd356286bb46e6bc28ac0b3bd0e4c582533c0
-
SHA256
76347603becb96ed56c8516381562074180e76c806b9c794c267b59f60e3f969
-
SHA512
b586547d773f817f0b439360f2db0d6b2f01ed27e5e39f641cea3ad81845f9901bc4a7eb143ddea83e1316ba1a20c9ff0198a745db945584611be8fd88e6bc97
-
SSDEEP
3072:uvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2HK:w1SyAJp6rjn1gOObn4b6h9Z
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\76347603becb96ed56c8516381562074180e76c806b9c794c267b59f60e3f969.exe"C:\Users\Admin\AppData\Local\Temp\76347603becb96ed56c8516381562074180e76c806b9c794c267b59f60e3f969.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5d7844758b196e52fcbf2642fdf1169df
SHA19ed043f8062b411c9300be068a53a517a5893ade
SHA25630f7948fc920bb1cc193cce814b84340e3070ba328fd159443332f7803737ac8
SHA51261c67cf854e229944107c8e501c670aba82cbf2630d1b45a11dd1624760ff8403bbd6ee61eea23ae50582c260c5ccad6ac59e5dd18babbc69c4ce7bbf083926f
-
Filesize
218KB
MD55f2840da3f22677ef5983210ad34a96a
SHA1c9ac2df5428b4930dca34e87e1e1538d9a3973bd
SHA256ba16951e2bafcbfd7b9253f8deb3bc568cec07c26e0861d11710c35771cf29d6
SHA512c69a78dfe3256c814e4d61e33b53b6755b0a92151a16fd2efa12330b1f4b3f5a5ad8661a86a46fdfd1ebb7b720a64e3d0446453c050932617e662822e1139185
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB