Analysis
-
max time kernel
115s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-01-2025 04:52
General
-
Target
88482806192b81972726ebbb5379c5dbf8889c78e93cff7414c209459a14d2deN.exe
-
Size
212KB
-
MD5
0f479fb5e91b6a5a1632dafe61cbc770
-
SHA1
e5f24abf4164c484e2e312eeee6420e88d74b329
-
SHA256
88482806192b81972726ebbb5379c5dbf8889c78e93cff7414c209459a14d2de
-
SHA512
9b484e0094578f0e0af3f99954f978eb5e31ddadcd8644d8e59d388eefe1e152801fe624f1c152e64b4f888e17449f972866243df0f24697bb6da64f967db99c
-
SSDEEP
3072:yGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb8:yG/iVkO20SFgBhxtW9mG9+Umt3Ezjb8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88482806192b81972726ebbb5379c5dbf8889c78e93cff7414c209459a14d2deN.exe"C:\Users\Admin\AppData\Local\Temp\88482806192b81972726ebbb5379c5dbf8889c78e93cff7414c209459a14d2deN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD57a6b17bacd9717df531cfb61ab6bf69d
SHA15d868b6919e7533c5a35608c6404b6ff37aaa0e8
SHA2568e783626791d8b5d6ae96037718b77ebe26c1f1670d5f0bfa9291eec1412744f
SHA5120dac6e298c98d8fc97aab3e7f32204c250af8281c2a0c5d22b5c6f9762916a258711527519b1d987ee426c59ee729e42799c247c96e7e2299f3030d817561d3e
-
Filesize
212KB
MD582ed780728d726e9cc6bc087c140b7ef
SHA10207885516b6192a2542756c55b2ba6325ddba0c
SHA2564249825c636710bbbdbe2bf13c97740bbc1151447c58dc48d0b40791fa1bbffe
SHA5126fe6092e8e749d734f62e0fd3eae183e72cc2a04564550480c49ba8429003e1bad02e04b37da78e4da7d40cf43721114b0a05ff329ce2e4b36d76f13ff6ba856
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB