Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
05-01-2025 04:40
General
-
Target
b8463708561eb05786916798ad24914b8842e07b93fb8570e782a9f5858f78ad.exe
-
Size
1.0MB
-
MD5
e3e8e2112441a5cf9e19e812d4b57acf
-
SHA1
951ee91b3777a8b2636d485b7ed25c3bcd47c6b4
-
SHA256
b8463708561eb05786916798ad24914b8842e07b93fb8570e782a9f5858f78ad
-
SHA512
364ae8a20074b68f9e7b040d8279583a4619c842e5c2f487394d4a7bcad463e30616e788e8180976614622bc88d699a3d8d76257d8ab418357a153cf0d3cdf65
-
SSDEEP
24576:dmUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT58:dmV2ApemV2ApemV2Ap8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8463708561eb05786916798ad24914b8842e07b93fb8570e782a9f5858f78ad.exe"C:\Users\Admin\AppData\Local\Temp\b8463708561eb05786916798ad24914b8842e07b93fb8570e782a9f5858f78ad.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5279250e03f81c8346f9a89d7a61dd03e
SHA11b870c2a1df969377eab0037ea56abc56e90fce8
SHA2563486fbcca4059db843007d64bd8e0ff2028b9b00ed8e2eb99b04b046de69447e
SHA512cffa72d47546c447a3bf0ec9eac1b79b2bb3c5bfef656035620067c797cafc10c3ad155dae92c670cb5b708f45fc081ba38d3477c34b31f51ca9bfa931975ef0
-
Filesize
24KB
MD58ae2e419b5679dd40a00dfd534194aa4
SHA1af499cddf09d01d136dc456dcaf431ab437ef9f2
SHA25689d3fc3f8ef941fdfc2d46db48c27dcc727dcd47fb5256f48d080c9a1eb289bb
SHA512790881ad5beefc1d5cb8b222914e449015277843945be150ab3941a13a8a2ab06cbdde464bb35b61e1b9098ba4fa7fc5c7a8602b0d3dda1c0bc6c78598535886
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1.0MB
MD51c7485d83a21eca5dec89534e5ce803a
SHA1534f539fd34282de6ed56e6d383fc9a644a2d398
SHA256b38ed06ab0cf87909758650b145bc2484a238039f453e40384bd56b1dc3903c2
SHA5129a5df6d13228985474caf2a7aa50bbc9c4145f0b5af40cebbef109f9c7cfa257fa131673dd10f05375dbf7f1bbaa9e0a3621bfb659181759aa74200667837c87
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB