Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-01-2025 12:32
General
-
Target
b061057a5b08703a0186859551c05085d1986dc7afa28a63f071b86406fed3c7.exe
-
Size
208KB
-
MD5
943bf47be85fde14a55b09a8a4509e2f
-
SHA1
f8c14d4c20b75730b0147309fa86a5470b31b58a
-
SHA256
b061057a5b08703a0186859551c05085d1986dc7afa28a63f071b86406fed3c7
-
SHA512
27f6c36fa9ef942350ab01421025b75b1fb85f9c1827f5829a893ab2b367d56ad8ec0218e4fd74fad684e48edfa0581caccd9682ba267f7a7863b0677b64a934
-
SSDEEP
6144:ta1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkA:tbapK0JCmRcU9vVokf5
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b061057a5b08703a0186859551c05085d1986dc7afa28a63f071b86406fed3c7.exe"C:\Users\Admin\AppData\Local\Temp\b061057a5b08703a0186859551c05085d1986dc7afa28a63f071b86406fed3c7.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5a2bf5018d498d5b6b421bc4cde889b42
SHA178e18fc5e1dfb95cb10d9906c88bbb9b5b99cc41
SHA25689283c7a618e3595c87310f17765e2cc6197799bfeb6b75062257318b4b40eb1
SHA512165d211052dae28f426849023383267b8358a7dc515faca3cee6bd3ca437c111f4319a60cce320621ff481d16075bad741a5e2d6ebf64cd1e0cd349f754b8aba
-
Filesize
208KB
MD5389225a0b357600f3d9c1727c9226c9f
SHA1317568d72ac6dfecdc11063ac118968626301a5b
SHA2562aa9fc22ce9f9a13eb3cd22c6260db69ba9a693c49d2511635563b0ffe720070
SHA512d3508d97458f6609ca32c054a53a961ae6a8ca94560e42e7d9ee9efd3dcb1bd250521d8f8e731a3915cd9215580df8b511c4107171e67218939aaf940f22271a
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
412KB