Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
11-01-2025 06:46
General
-
Target
d04ff245c9d94b3459d44329e7bf20d3738028d7d3c716b8d559938a4f97ef20.exe
-
Size
218KB
-
MD5
52dd2b2dfe391ceebcaed494c3cbd673
-
SHA1
612221e3ea446c4944e76b8e4c21bddcc8a25266
-
SHA256
d04ff245c9d94b3459d44329e7bf20d3738028d7d3c716b8d559938a4f97ef20
-
SHA512
67dba2dbc0aa03e80725da43fe9b4ac3b49c4325e917de2a9c228266eae1190b69192da8110ea06307d6f4fbb36c502f34fc0cc09603c12b76787c8723237996
-
SSDEEP
3072:6vm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:M1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d04ff245c9d94b3459d44329e7bf20d3738028d7d3c716b8d559938a4f97ef20.exe"C:\Users\Admin\AppData\Local\Temp\d04ff245c9d94b3459d44329e7bf20d3738028d7d3c716b8d559938a4f97ef20.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5d1fd7d858409d286071f5f796c23ff87
SHA1f7fab37c7b22b091102890f603be57adc4800a97
SHA25606a0d4f29fe9caa850cc749e95940c09a0a5110b3b014249355460bcc3e2d35e
SHA512131554a0b111b2de944d5d212df471c03833f9f80d56b13a59afbc389cfbc56387a8fa1e7419e2ff18e6a290a0e3ff8bf75a07d1e678a25681d776b2b330110a
-
Filesize
42KB
MD5ea1f1aebdf99aa8c4e811f4ce5254d58
SHA1a9253ea72978d8717ae42314caa8457ffb4b4680
SHA25670c16f026e33059e316e679879a18335c18d80012ba9dbdca27089a14011949f
SHA51214def478cbc22a38392c13fc9af3312ef0aa19d8a9b13fea2071d271efb541479d06c8f6214f63328bb0a97e1f9e50c08f27778dd202a0c511508ce823e9c1f7
-
Filesize
218KB
MD5a99eb1eb9f542a04186fad799d948426
SHA1b6f5379e0977ef881b650d84000cb9068a5ed6a9
SHA2561479076915e0e9805614a73c7a4133a858f6d4e5434c7139f048d801c6e3d419
SHA512889e910f0a5c82226865cc1237118d5b2b5d8fdc61d8c9e0054b4103943064a7e7943bf10cc9edc8a28a0f40a7d284fcc3d54a3d35f17dc5885c807b483f51e3
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.7MB