Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-01-2025 18:42
General
-
Target
836461de32882d61e1502913093802f24bd92170847c59d8ee9c6e2cfbda373bN.exe
-
Size
212KB
-
MD5
9301d904b5ba6a6ba985cfa7ad1357c0
-
SHA1
8b42b4f0b385f000d116beb2b3cd46232022b179
-
SHA256
836461de32882d61e1502913093802f24bd92170847c59d8ee9c6e2cfbda373b
-
SHA512
ed1f792e4965e6190433b0296e83d7eb2508132262abfbda581578ff0a87f09ba58463c806d9814e45bfb0b3f941bf0bbf5f024295f02df3943a9cdafd14399a
-
SSDEEP
3072:xGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb8:xG/iVkO20SFgBhxtW9mG9+Umt3Ezjb8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\836461de32882d61e1502913093802f24bd92170847c59d8ee9c6e2cfbda373bN.exe"C:\Users\Admin\AppData\Local\Temp\836461de32882d61e1502913093802f24bd92170847c59d8ee9c6e2cfbda373bN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD546be811a211bbdb12475b0045c9dd714
SHA16bd31132a3335a34dc9e5f2d55ceb28aeae92d02
SHA25609b9349abf05e345765dcb2cf7e258eec58dae4383a8a8e75b1ced648a71441d
SHA51291739dd0972f3098a30adc25f034074f5d27691ebf4783fc93edb4da461716aa7dee4c549042f420479b5e8ba32dfc92d4db98816e6b85db0d9e859461cfadb1
-
Filesize
100KB
MD56d927e1a1fe1696db71e20ba30fb53d0
SHA15cb3287a906fe1ec88b72c079b5f5bd1255684c4
SHA2566f510e7ae2b9263adabfdeb6df713d29091c4d4c8c7d348748f82c8ee471b014
SHA5120a9a03bdeb98c18ea3c7b0ecfcb3616214cc506edeb4719477d2d2c6233a057caa239bff061d186b05c8e4a47a538cac510fcd2627f320f43109a3f5d4dc2367
-
Filesize
100KB
MD5f781487cd275e8271b96c0ac3e2899a1
SHA13078a1794d5b4ed6f3e17d52f049bbaf6d091fda
SHA256925c21a8cc643d809cfb1dfa85070126d4269d7a88e26f25f51675036ea02ec8
SHA512c3f140432279f3219453294175cf4efc23328f9a9118166033628b3ec71f97fd09995053a7e5828dfcda3704a91ac93a6866cc9cb4dc207d29a57cc9ab4afe5e
-
Filesize
212KB
MD5bba06dd462b3dd61d866236e6294582a
SHA1a90b17beac79737cbd1ce3b389938b39eb3086fc
SHA25641ad1443e0d5fcf33c20a6f18abf68600f7903ed44687d4e62879daa388a8532
SHA512e87e981626fe37226c590960f7e4bf31849325ad51162886f24d768167b12c5f2b7d6b14d3ceb5237736a6bee73d6a005caa3e153481b43e7d7f564105a8438f
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB