Analysis
-
max time kernel
111s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
16-01-2025 22:58
General
-
Target
760d0b9175f922663ba0538438be086dd7c1773c3ce11758d68faae604a5f976N.exe
-
Size
686KB
-
MD5
dfc9ecfe4daa45c893646e5c87eb4630
-
SHA1
e67b08a1785a416bebdfcb33a969ee62cd01fefd
-
SHA256
760d0b9175f922663ba0538438be086dd7c1773c3ce11758d68faae604a5f976
-
SHA512
5cb60c560493acca8ab04d5c4276a46287ade9edf839c5b02f8856beb8506889d6e08cd2fda1159852d99a5a7371a72bf1e6eb0205eb00220798b936fabd259e
-
SSDEEP
12288:hmWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgpH:hmUNJyJqb1FcMap2ATT5itjCYZ3DSoH
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\760d0b9175f922663ba0538438be086dd7c1773c3ce11758d68faae604a5f976N.exe"C:\Users\Admin\AppData\Local\Temp\760d0b9175f922663ba0538438be086dd7c1773c3ce11758d68faae604a5f976N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
24KB
MD52e4d82d7294aded967e051cf806f39b8
SHA15eee1751ff2155bbbe697e8a2291c81354e63ccb
SHA256517480485d94f26e9203d8979fc54151275b72372f41d48596e7bda36648d93b
SHA512739f35a66dc2b96b6dfcc36290ca55bd24e790c001cf19949d7abdb85e9499baa25b4bc9a652c8a14eefe1a10b253e5e6bb09520a006083c914f40279d7e4740
-
Filesize
42KB
MD5af1229bea809e8afee75aa7db90a5ad4
SHA17597bae59d77a462b686b7db1fdc8f53559bf9d3
SHA256e37bde898c9d9ceb02276142f6125dbcf49e78179be2291de61d208f20d0575a
SHA5121ee914ac0587ab31ae295c4ddb3c461949829437d01aa24fccdf6fc69f13bb3e82f38adea25b3810dff543ec91ad3288dd7637b1da42741f976cde3b01ed1a0b
-
Filesize
686KB
MD5d616049079270e5434ab224e12860880
SHA1dc13fb7a7dbdde2eb5d60789d4c09551a85b3d52
SHA2567c472049f0d23d2ee4c0927e529766bb34f88b63f074b02290286885d17c24f5
SHA5121591006b7d2ea0003646e7787f10315e6a33c6be92d7f8d6cc42c94bdb12f5e1320ded05af85a257f92e914b1006feb82b4de6acd852163e6a87c61b783845d1
-
Filesize
732KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB