Analysis
-
max time kernel
111s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
04/01/2025, 08:51
General
-
Target
e23f3b1ff656ecec579d328bb1bcd049aef4c3b6b235863b591bd298f85e52b2N.exe
-
Size
201KB
-
MD5
629917fa69a09129402bdd870b161610
-
SHA1
b40772cdbce5d0790dc728d3f3f6394190af12dc
-
SHA256
e23f3b1ff656ecec579d328bb1bcd049aef4c3b6b235863b591bd298f85e52b2
-
SHA512
ec77b819c2c834b24b52a0e54390697752c7922044b65716ff50400a57b7499f93a29fec268f4785197abc2d8e542e776269f5f7ca928bb84c762f21fda962be
-
SSDEEP
6144:Ut++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:n+cff22qZhZcKYhc/
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Program Files directory 10 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e23f3b1ff656ecec579d328bb1bcd049aef4c3b6b235863b591bd298f85e52b2N.exe"C:\Users\Admin\AppData\Local\Temp\e23f3b1ff656ecec579d328bb1bcd049aef4c3b6b235863b591bd298f85e52b2N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5d24b13ea3cff7995c9f2234e32f9b326
SHA17634a85b20e58d4197d3014494f7a4f357abea76
SHA2569767530b3d5d8db76bb5c0558f8a8cfb1c0f47866c101f7deb3ef9e350a66b35
SHA51224d241ee4a33d4e6ad0348d8e56fe1932ea74db31218444dc5ae1191458d7e9641c2ea7ba7b2341be6528cdb607991e85d377412d437e7479af9839e6d83c9ee
-
Filesize
201KB
MD51b1def862c4d10cd7e7cb27d24f7857c
SHA1dd4eebe82a0224141c16fa41fb851a0651a3b0db
SHA2569fd5b46a977c28d7e221c83af036157b95ed40cdaea5b78867c3948cc0671318
SHA512a1b57e737863943a0994c34b56cf4bdd48f818e2ff781a4475d24c0deefd8d77ae66c3e4c2c9bfa9d1cade630fddb027f481e8aab10ff9e47918831d16f0093a
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
656KB
-
Filesize
580KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
580KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
368KB
-
Filesize
580KB
-
Filesize
368KB
-
Filesize
316KB
-
Filesize
580KB
-
Filesize
316KB