Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10-01-2025 04:40
General
-
Target
95491e894b8d5af827811334ea9dc09754bcb1403ece7eb665b08b65a065bb44.exe
-
Size
355KB
-
MD5
4b41e8ed252483b8ca474332a0f09bc1
-
SHA1
ba76a993e3426829826bf163d67adbc92e9fe254
-
SHA256
95491e894b8d5af827811334ea9dc09754bcb1403ece7eb665b08b65a065bb44
-
SHA512
6e0b2bd62d76a18272c92d9a1621c12fa1cf17f6e9c6ec8cb45c0852287c7946ec7021b69a0e2dc96ab58da6d636282eeb499031474a5fbe9c9d63f149718f4a
-
SSDEEP
6144:L3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:omWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95491e894b8d5af827811334ea9dc09754bcb1403ece7eb665b08b65a065bb44.exe"C:\Users\Admin\AppData\Local\Temp\95491e894b8d5af827811334ea9dc09754bcb1403ece7eb665b08b65a065bb44.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
42KB
MD5db89672d16ca9776dd14c51693d037fd
SHA14134675507f4d07d75b76972bd59968dd0ab457a
SHA256e65dc77da4b0ede86f2b85487bc97aaa52890b5c2e7da82a168589f9fe3ad042
SHA512609a65e0d7d5894bec5c8c79a19099951ca9bf1622fd0ebc8290abf875753864ce567009f8b701ecf71c9049712d96595b183a5c5ce72be9afeae66b3ae84879
-
Filesize
42KB
MD5785c53c71858e95869f90f63f3efdd9f
SHA19f079ab9df874591bfd4b38556291d66b7f71d77
SHA25678226de44e5ead3c7db1f65940e8189bd4c18078a4d1d04e88debd85c2b67248
SHA512dc8b40ed6b8a3093de4b57c5b6e0d98dff19618aff43ca3d4cea60bf7194bfbf7d446fd1c730aae4c3283677970e6bb5184f05d77522cfcb3bda9142d64de80f
-
Filesize
24KB
MD5c31e5e9aed7b196f269da24c663d1561
SHA183753a27f4c76f1a01d09f54a3f5891a083b9e2f
SHA2569488e07cfcbed1e3e88066b18afc5774db5ada43ec67a814f35cd82f9f8f64ea
SHA512aedc76bb2d37ec380bdc38cfcc6a9a7fb04e30111323ba6f0ae4a13d6d588f3fe0f3b6415d252f786de75b639884197b4213ae0ae8afcf5d9569afcb0da16eb1
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
355KB
MD53004baafcb6eef8e8bbf6d3e64ac4d68
SHA186d4b38deedf8f286b4b40c77de7052b301af30e
SHA25688edc058f20e0c776a81c252bb6f93d0de46865eee835ad5517c3c7a2985c455
SHA512a6f05bd42c760d436ed6c7cf47347ccfb5cbd9ff8c72ee983a304524f320c8b9a5148ab321f3aa647bb0241aa0d1f54bab347753aad6ba00d20d2573b5399a2f
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB