Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
04-01-2025 06:17
General
-
Target
63c30940b223e71b78e426ee15969deb61006de6e73495751a763aac86cf9010N.exe
-
Size
218KB
-
MD5
3a221330e2c1cd69c3e5da9815afbba0
-
SHA1
13a465a1a870160a442d6d7dd1b29f0ac96ebef4
-
SHA256
63c30940b223e71b78e426ee15969deb61006de6e73495751a763aac86cf9010
-
SHA512
f20ccd602e452b1a63965fa267d5d0068cb35755b5008e7e3c6c6d6b49125ba224b7fa626f63c002b215bae8d773d04d947a9407fef5f13ee79231d433ff5deb
-
SSDEEP
3072:3vm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Ha:/1SyAJp6rjn1gOObn4b6h9x
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63c30940b223e71b78e426ee15969deb61006de6e73495751a763aac86cf9010N.exe"C:\Users\Admin\AppData\Local\Temp\63c30940b223e71b78e426ee15969deb61006de6e73495751a763aac86cf9010N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD53fc7fba74c9ad79a7a38f46fe5d8768a
SHA1320e5dcd688cf82631821ba3837663951f86c885
SHA256b7442c50ce534094b5e0fb8b36be83b1725289917283a5a808cb2d27d1d8dd4b
SHA512e1824367ddcb305a148bfc707a33245e4607ee4b38b65085d7f522007665b5cc12f9a672bec4e62df2f42de19348699f08a810301fdf3f2ad89f9df8729ba942
-
Filesize
218KB
MD5109ce995d8986c4755c7caabd4941dfa
SHA1c4d449a55a548c80665ff4a81def06983ad63ac3
SHA256aa13d507ae1faa3140256ce38aef58de73f9a126cbd712a5a844a5606220a9f7
SHA512a7503af7cf812637db4ea3a5a39aa7fe2f0e2949eccbe120beeedeab40b1651757fb831f7fbf78b56d47c5f347615c2ddec022baebf2d62475c9704dffebf63a
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.7MB