Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
11-01-2025 23:41
General
-
Target
4e3ccc35555fdb5a65fa808b0a5a674e44ccd4e6da5316f6ba6651814ca3efe0.exe
-
Size
355KB
-
MD5
66e144b221c8460b772c3989d0ccf9bb
-
SHA1
d1597dd0e5f098a51e65570ec183fabee2800071
-
SHA256
4e3ccc35555fdb5a65fa808b0a5a674e44ccd4e6da5316f6ba6651814ca3efe0
-
SHA512
63bb4ca34fd2c5651b60c2fdf2fb4d1946bee4035008a34939c99cbbabf3b27a60a11e7023e1aafde8ab70fb9aaa4f9a2eed8815351736b170481bee491c46f2
-
SSDEEP
6144:i3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eim:dmWhND9yJz+b1FcMLmp2ATTSsdm
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e3ccc35555fdb5a65fa808b0a5a674e44ccd4e6da5316f6ba6651814ca3efe0.exe"C:\Users\Admin\AppData\Local\Temp\4e3ccc35555fdb5a65fa808b0a5a674e44ccd4e6da5316f6ba6651814ca3efe0.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD52a2bf32f124ff5414cc6b3e3a440cfff
SHA19bc675deab7005cc1273dafef0e1456bed38d1d8
SHA2569db0eb7a4e8ee37bf82eab29ed344fc80e13ffbb7912e2d9c755acaf17bf4e80
SHA51276a75fe931380c89fa0578e08c25496dce525a31621a6a40969df8e663f1f227d25cc13fefc7bd7bb9c8e1a2169e9d48732bd134b0608e0fa1d7f7ed2c9d18f7
-
Filesize
42KB
MD50249abcdc75d4c80593426be247e2516
SHA1459a27e50429860b923c043d09b56e2202bc9ede
SHA256a10a3d8339c2a5f293b9ce3990e511e6293b34fc19ab969d1deff63dbc5a6154
SHA512a11c2410b7009c427b02813276df91dd1b52262928500fb1900da552680c42769e97cc0de1d12b1288d8f29234ba93b5ac0416b51994b3bf112afe85e272fbb0
-
Filesize
355KB
MD540d89983c77e062f0bdc4a24c0c0b621
SHA1557ab05f46bfdafc2b178818d3533a476ea2565c
SHA2562049186928130c042f253ba71b5d6e1da05ee99764f9dab0297d26398c4ccb95
SHA512691d2e1476c26137c993b241cd380e102898ab4c16f148c85897f843a028956c03593f36de279a758b057219ca36e80a22d58340b44bae052c3fd27458776f90
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB