Analysis
-
max time kernel
116s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
07/01/2025, 18:31
General
-
Target
7428d92765c1917aad7cc856c5b00dcef28ee1ce97e2a106b06a7aa026a94f34.exe
-
Size
218KB
-
MD5
c164fea5774a5e7c18e38f9a08bf2e9d
-
SHA1
3c9552c53df613fc6ee7d22ebe822ed07dcc3e36
-
SHA256
7428d92765c1917aad7cc856c5b00dcef28ee1ce97e2a106b06a7aa026a94f34
-
SHA512
8a23d30d8481bd61579e525236e6990b267a5d1f6b83d56d07cd098cbb0aef3f43c8e4cacd14a5e3cecee02dd4f4ad9cd6d2f360083e5b62d2d7351de9fbdbe9
-
SSDEEP
6144:HEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICG:HEGDdQNHEwWlMxYG/wIJ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7428d92765c1917aad7cc856c5b00dcef28ee1ce97e2a106b06a7aa026a94f34.exe"C:\Users\Admin\AppData\Local\Temp\7428d92765c1917aad7cc856c5b00dcef28ee1ce97e2a106b06a7aa026a94f34.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5788f9f0a31ae23a94e9322541ad3d8d8
SHA15b9ba9b2761491b82cdffa5ae894ad1ec5a9316d
SHA25624e616b790e9bd138deb793e4eed7bfbc0cc0d7d2e8cabf0275e9989155b0ed4
SHA5125a1ec5c13fd563091b3352b56b3ad59f1a007333d78941b756cf6cf954b4bfa301d47734f8e4f9bdb1584893b7e0b64f82440c56ab8b2e25cbc3926c8fb05a46
-
Filesize
218KB
MD5df0e907a074954b453400e0424a860ef
SHA1c38afa3a4bf3fd64927574e92ca101ed80867295
SHA256aa1fe7264925dc9f112d3fe8b3063ade8cfbc2ed6132f4e258878759836c7941
SHA512f446418f8f141f1716caa67aa09d4928cf943b6efb4c5bfe019654f15c82c05027822de5cabe2267cad1cabef13885195596b9942b50e4d3420e0f0f47b3176a
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB