Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-01-2025 11:19
General
-
Target
091cec67c2241dc4841cbfd349f5d482e7e859a34b513e1c5d5299a3fd4a8723N.exe
-
Size
204KB
-
MD5
e4290ae81e01475ceaab0eeaf52bded0
-
SHA1
972395ee5f68d480ef3a9b81d90aef99441e5609
-
SHA256
091cec67c2241dc4841cbfd349f5d482e7e859a34b513e1c5d5299a3fd4a8723
-
SHA512
4e4850e2d5a7cced63b40ac58912f7e5488540f6116d6e9030f410a6c1eba841d97eb036eaf05f653a12ba5dbb82b7be4a2c969bcc8864b0ccb7772bc4e7dd4e
-
SSDEEP
3072:v5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:vLexkuRaX41xoyJV65gzyZko+ucR
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\091cec67c2241dc4841cbfd349f5d482e7e859a34b513e1c5d5299a3fd4a8723N.exe"C:\Users\Admin\AppData\Local\Temp\091cec67c2241dc4841cbfd349f5d482e7e859a34b513e1c5d5299a3fd4a8723N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5ca5b115cead4c9541adce0a2981ff690
SHA1074fc12ff6521d033f545e462e16bab602049131
SHA256ff7ef75a718820be12dcf0615368a42cf6eaaeec925e98be1812d0d03fb29230
SHA512425b9daaefb86946a0dd3b9d15317337036d80608afcee945fe351c983820e987b93cda36fce3a8d8a9be1a84a73dd925e21222d704ea48a1d8d6dac25a236e5
-
Filesize
204KB
MD5e23b1d4f0c159a5ae141f67dc22ddfed
SHA1e69bf10687debb348273c5d2c8a12fdcf2827396
SHA256b4bc6535f76717b628acdb72d4d884c70737701b5f4346ae76b3455802fee3a0
SHA51298bccd7ec22b542ecfae1c38b5ba1c63f4aebd9e656a422a05e2ce36424475a3ee51ba0e214339dec37aebbfbcb874a7cf4bec6f7b1b47c21d818e7136d35768
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB