Analysis

  • max time kernel
    116s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2025, 18:31

General

  • Target

    7428d92765c1917aad7cc856c5b00dcef28ee1ce97e2a106b06a7aa026a94f34.exe

  • Size

    218KB

  • MD5

    c164fea5774a5e7c18e38f9a08bf2e9d

  • SHA1

    3c9552c53df613fc6ee7d22ebe822ed07dcc3e36

  • SHA256

    7428d92765c1917aad7cc856c5b00dcef28ee1ce97e2a106b06a7aa026a94f34

  • SHA512

    8a23d30d8481bd61579e525236e6990b267a5d1f6b83d56d07cd098cbb0aef3f43c8e4cacd14a5e3cecee02dd4f4ad9cd6d2f360083e5b62d2d7351de9fbdbe9

  • SSDEEP

    6144:HEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICG:HEGDdQNHEwWlMxYG/wIJ

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7428d92765c1917aad7cc856c5b00dcef28ee1ce97e2a106b06a7aa026a94f34.exe
    "C:\Users\Admin\AppData\Local\Temp\7428d92765c1917aad7cc856c5b00dcef28ee1ce97e2a106b06a7aa026a94f34.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:576
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\D9B5.tmp

    Filesize

    42KB

    MD5

    788f9f0a31ae23a94e9322541ad3d8d8

    SHA1

    5b9ba9b2761491b82cdffa5ae894ad1ec5a9316d

    SHA256

    24e616b790e9bd138deb793e4eed7bfbc0cc0d7d2e8cabf0275e9989155b0ed4

    SHA512

    5a1ec5c13fd563091b3352b56b3ad59f1a007333d78941b756cf6cf954b4bfa301d47734f8e4f9bdb1584893b7e0b64f82440c56ab8b2e25cbc3926c8fb05a46

  • C:\Windows\AppPatch\svchost.exe

    Filesize

    218KB

    MD5

    df0e907a074954b453400e0424a860ef

    SHA1

    c38afa3a4bf3fd64927574e92ca101ed80867295

    SHA256

    aa1fe7264925dc9f112d3fe8b3063ade8cfbc2ed6132f4e258878759836c7941

    SHA512

    f446418f8f141f1716caa67aa09d4928cf943b6efb4c5bfe019654f15c82c05027822de5cabe2267cad1cabef13885195596b9942b50e4d3420e0f0f47b3176a

  • memory/576-0-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/576-1-0x00000000002F0000-0x0000000000341000-memory.dmp

    Filesize

    324KB

  • memory/576-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/576-17-0x00000000002F0000-0x0000000000341000-memory.dmp

    Filesize

    324KB

  • memory/576-18-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/576-16-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2272-19-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2272-20-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2272-21-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2272-22-0x0000000002200000-0x00000000022A8000-memory.dmp

    Filesize

    672KB

  • memory/2272-32-0x0000000002200000-0x00000000022A8000-memory.dmp

    Filesize

    672KB

  • memory/2272-30-0x0000000002200000-0x00000000022A8000-memory.dmp

    Filesize

    672KB

  • memory/2272-33-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2272-28-0x0000000002200000-0x00000000022A8000-memory.dmp

    Filesize

    672KB

  • memory/2272-26-0x0000000002200000-0x00000000022A8000-memory.dmp

    Filesize

    672KB

  • memory/2272-24-0x0000000002200000-0x00000000022A8000-memory.dmp

    Filesize

    672KB

  • memory/2272-34-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-36-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-38-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-45-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-44-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-82-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-84-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-83-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-81-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-80-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-79-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-77-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-76-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-75-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-74-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-73-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-72-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-71-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-70-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-69-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-68-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-67-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-66-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-65-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-63-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-62-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-61-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-60-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-59-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-58-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-57-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-56-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-55-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-54-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-53-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-52-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-51-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-50-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-49-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-46-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-78-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-43-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-42-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-64-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-40-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-48-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-47-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB

  • memory/2272-41-0x00000000026F0000-0x00000000027A6000-memory.dmp

    Filesize

    728KB