Analysis
-
max time kernel
117s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-01-2025 14:55
General
-
Target
f7b78f7ccfd2543c10ddad54317082b90e93daa671415d013cd3d4e9a96e034a.exe
-
Size
355KB
-
MD5
b3b1a2b21597dc7c539ed2bfcadbc0d0
-
SHA1
5bc2b693747e858c05ce60ff0641056cf5a5848d
-
SHA256
f7b78f7ccfd2543c10ddad54317082b90e93daa671415d013cd3d4e9a96e034a
-
SHA512
0ca9217352f7a825f228a7ceeec51ef9a25f8dbdba0da46563add09225ef2e248bb747562295bd55277600d24c9a99b7bea4193ed0eb8a1bcaf6c43f71fca96d
-
SSDEEP
6144:s3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei2:nmWhND9yJz+b1FcMLmp2ATTSsd2
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 49 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7b78f7ccfd2543c10ddad54317082b90e93daa671415d013cd3d4e9a96e034a.exe"C:\Users\Admin\AppData\Local\Temp\f7b78f7ccfd2543c10ddad54317082b90e93daa671415d013cd3d4e9a96e034a.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD53456bfe468f08e104722324a52bf77e1
SHA18b91a274801e2132efa38187ab036175280f2e0d
SHA25623e2e132ad057a93d265d8c3d14497e6a8905c2f9fe51ed19573d6c40d467c1b
SHA512714a66e3aaab1a0daa57b1f25aa04294aafab240733aaf48c349557cc6019d726ba58b9a5cbba2e8e8167eb657cb5e14ff2994c37490735f65c452fff85f2aac
-
Filesize
355KB
MD5125e5af360a0f8efd3a6309a99f8b2c6
SHA16522afd9824fde376158c0b7fbb57556441af43a
SHA256154da83dd34b0858a24a3b5030d7cdcec9510f611a6f74f41e4dcd52e39d37a8
SHA512c7ce64e1f52c84e16b660507f55caaf237e224cf8c0243ec1a59f15ac11e743ce30c4ce84fce7c6990b27235e78c4798c028ce40ff56a456cd2063142902588c
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB