Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
03-01-2025 12:04
General
-
Target
697cba74fa578745eaf984b11ea3c21b3c7df7dad9d0bf04f34fff993e414b4bN.exe
-
Size
686KB
-
MD5
a47bfced1b5cd240c8caa05a4d6a2aa0
-
SHA1
5cbf0259e4b633ea4182d34904cbba521da89bd7
-
SHA256
697cba74fa578745eaf984b11ea3c21b3c7df7dad9d0bf04f34fff993e414b4b
-
SHA512
06741ba129757ca8d9cf52e8e7f4f4a3ad7b573e7072e4473d12dfeb5305f147239fcecf558f5f4adf41585f2d1ff6a01431051442a55dfa324153214540fb11
-
SSDEEP
12288:dmWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgp:dmUNJyJqb1FcMap2ATT5itjCYZ3DSo
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\697cba74fa578745eaf984b11ea3c21b3c7df7dad9d0bf04f34fff993e414b4bN.exe"C:\Users\Admin\AppData\Local\Temp\697cba74fa578745eaf984b11ea3c21b3c7df7dad9d0bf04f34fff993e414b4bN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5a9bad97f0d5bcd7d01ed591a2cd94c02
SHA17454575ab6ecf78717bfc3795e7c9be9b5de139f
SHA256f6180921809c3c4de0ffc3efbbdf5426834dec924b90082a2afe14ec1181e3c9
SHA5126e6173f83d5b408a65b55ea10d550aa5a9c75e9203fc64fe5ab16185ba235c6f31135abbbd1f7b7e8d5ce3540297a8d378f41d811c79c745151e1ce8adde422f
-
Filesize
42KB
MD51a2230ea9da8aba166a7566f0bf46b6f
SHA1655cf843ca136ecb286ebcb96b24cfc50e780a24
SHA2565b1e36beba2e4fcff630db5b0dc702925f6237ce8ae03beb00586be3d6c50ce2
SHA512becdab448165d3a201631f3f9ecd9e4d8bac1f70f0f5a0ecbf6da1705969756be91fa878c3a69f1912705974197a6092268dafad087916f7cec64ed6584ce093
-
Filesize
686KB
MD510ab57cbd653284fcdab180fa949ede2
SHA11f6570da892e8d09e11a88d269806864f0a8bd5e
SHA2566878616f5aafd632609b2690cc6b516c95479827432facea7f8aa56f6a0ec25b
SHA512edeafb947a0963ccc91d18de34a77079fedd552e60fdddb825a8682fb8d708889df58cde083cf5d3d49e1f88fa1851734984508aeabf67b6af5fb74d7ccc383e
-
Filesize
732KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB