Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-01-2025 11:22
General
-
Target
1417a63ca2c2bbea752fc2a173a920df76aaa9552b756f1bd650f4dd91e6fbe5N.exe
-
Size
218KB
-
MD5
03e25e0aeb3d73ebba250df644707a60
-
SHA1
a2b80326274afc9b1e3d7aa7b14f08f227cc74d6
-
SHA256
1417a63ca2c2bbea752fc2a173a920df76aaa9552b756f1bd650f4dd91e6fbe5
-
SHA512
ab29dbe2bba4310531ae853a7af3fe5eee846933bf565a76b7e6d15a8f9df141a89e5d0d8bf66900f559037744d6335807fe1e7b855ee83acb9c449d4b034a35
-
SSDEEP
6144:1EQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:1EGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1417a63ca2c2bbea752fc2a173a920df76aaa9552b756f1bd650f4dd91e6fbe5N.exe"C:\Users\Admin\AppData\Local\Temp\1417a63ca2c2bbea752fc2a173a920df76aaa9552b756f1bd650f4dd91e6fbe5N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD50eca3f3c09b22eb228334babbfa3fedd
SHA12dc8f9c8591d502c2597c639c83f5e583d029baf
SHA25645b492b4ded6c861edd96be06610514566c7de4122912abe83d23d7174e4439b
SHA512f06ace09ebba9bdc886137cc5124dd9ffb55bb0d97e2428d08a4dfae6956c22a1841ece6475ec3baf729de9482fde968c7ffc08debd177611f055b8effb11949
-
Filesize
218KB
MD5ad8fd52d7c904c07170388d6c279f151
SHA128f500ce16821ffab57c28f425868d8ecaa99fcc
SHA2560a4287255ed92cd215bcbbc0e000c14a5786a9cd66f3760d561105ec4b424067
SHA5121b6844e6a60558aa769ba9f43229326fbcade9740823596353c8b4ac638ddc8d16fa6e5a769281e8fd414e153ade2b9688b4c9be88d95091cb84b7c135e3ef01
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
380KB