Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-01-2025 17:56
General
-
Target
320d8d3b306a6cb189ad994aea7f0ae4255b1e6c8bff63b461efed5e3151bc19N.exe
-
Size
204KB
-
MD5
ff2c027b0a69735e25e6e2d4182987d0
-
SHA1
80e8aa57e38152eda5d47488fa0108abb4842e17
-
SHA256
320d8d3b306a6cb189ad994aea7f0ae4255b1e6c8bff63b461efed5e3151bc19
-
SHA512
5d6999f32335737807a6c8442ee7223e540f7d812113cf97730431707277da54258a888ba4fddd26b0c2b93528899ca828f68c867034bb69661f588515725a4d
-
SSDEEP
3072:W5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAQ:WLexkuRaX41xoyJV65gzyZko+uc
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\320d8d3b306a6cb189ad994aea7f0ae4255b1e6c8bff63b461efed5e3151bc19N.exe"C:\Users\Admin\AppData\Local\Temp\320d8d3b306a6cb189ad994aea7f0ae4255b1e6c8bff63b461efed5e3151bc19N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD595e47531ccf51095fe9e62eee744db4f
SHA114888e0fcebbf11631e94e2b32f63afe2b54333e
SHA256c626ec8bb17517676b313a37fa282be376bb04a8a87c685162000a5fe60620d8
SHA5122ef00383b584250725f13eb3349dbc7891f6fc4e3aaf1dfdc68da461352d850b4d5bcdcbc0b15fe6320c1765baa5e43721961cfaac891a7c230146b45bb8b59d
-
Filesize
204KB
MD526bc1552fd875fbdfb355956b377bee6
SHA1a399ba0e6957eed5e5ad33ed961adb2a606db2ab
SHA2567bd0dba19673aa792467da7d90f337901aa7df96f7834714e4da8bfbff897518
SHA5120ba34ba1db0837873fe0947f9cc8a7cea4f4491ff2bf9804da7eeabc2afd0c08fd6c4765cc89b573a27e3f62c8f75491aa86b184ba3b55502dcaaad453e5f347
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB