Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
11-01-2025 17:19
General
-
Target
9c6abae742262ec724929149ca47a978b3f100dc045fa81ac03311c579cb1aeb.exe
-
Size
212KB
-
MD5
57c4d62f91948647271d1fac86ba42d6
-
SHA1
57dd098588ecd670c321435c8c522da438da390f
-
SHA256
9c6abae742262ec724929149ca47a978b3f100dc045fa81ac03311c579cb1aeb
-
SHA512
1ef56432d25c9f7dbcc28d8302943a77549ea53de2b0bde74c593d5c2b055e9593031d3507a9c17ba37defb9e0cc2b4a4fcccce26f5fb437245cf87f6135c81c
-
SSDEEP
6144:Zob34ERMS/H7YAVsobrVn5G4E3Hi96mbQzJWFO8Omw4GZ:+boEj/8ASWM4Ki96/zqIKGZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c6abae742262ec724929149ca47a978b3f100dc045fa81ac03311c579cb1aeb.exe"C:\Users\Admin\AppData\Local\Temp\9c6abae742262ec724929149ca47a978b3f100dc045fa81ac03311c579cb1aeb.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD572000307b2935e708ad3a9fbe4920882
SHA186f24a2c982c7dd34c50c7793a8433bcce1ddb73
SHA256a62bc21ce4b9f8cff612d80dcaf2f08ccdadc990fb2ae064f3acbeaeafa345d1
SHA512c3f3c78338a8e5d1b158bc07aa351b4d220dcaee68544009f7a833f27ebed1f1bc5d8dd495b98762c2f1bb8b81c31832f77b16f9c7a7ab4eaae394652a1ee25e
-
Filesize
1KB
MD54f8b1d06ba3ad2d3b688cdcde8a9b636
SHA1859ab279651c655e19bf30d5fceefa6040922ea5
SHA256361bad6b4c5f1eac78346aa188cdafd318c6ff99643f42b48be91207115a74bd
SHA512be48e3c8173fab9cce00cadaa93088b017666c3e592232f11e9c54bbc5ad9f3244f5daeda579d9c4e37fb69e2fe18a83e45a5347c0e914dd2da0d57580f71b63
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
212KB
MD528616f35c3802382a9be2d00a2ef4b8d
SHA145899f8c53a69395666852b5aad2f0cd5139d776
SHA2569467fecaf8c5a8f3722f642c2a244d3484c09af1dbeefdce5b13a55ef9bd9b24
SHA512791927a2eff27b3196c5f972450a32bf8f582ebfb88acde11fe2e9d8de85b5bf3eacf486dc2c9c9b3b04223e319fb16b0b35cf60ad875ddf7088fe936f854b05
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB