Analysis
-
max time kernel
112s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
16-01-2025 07:05
General
-
Target
95f69d4ed6d5f172f7c3fd214102528498541c65e1dca2283ad435740ee19a83.exe
-
Size
204KB
-
MD5
a25862f477539bdd854f9dd40f8bb83d
-
SHA1
39b9f103e539336bdcf7a8fbbc71167491904fe7
-
SHA256
95f69d4ed6d5f172f7c3fd214102528498541c65e1dca2283ad435740ee19a83
-
SHA512
51944edacbf8ea3d6863293614100178a0478c8ca347e0dbb850f82be943bf12c19ac8d598d714eab41e6206a9d9f234604602bcb7e3cd2df226c35f80ddd10b
-
SSDEEP
3072:25u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:2LexkuRaX41xoyJV65gzyZko+ucZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95f69d4ed6d5f172f7c3fd214102528498541c65e1dca2283ad435740ee19a83.exe"C:\Users\Admin\AppData\Local\Temp\95f69d4ed6d5f172f7c3fd214102528498541c65e1dca2283ad435740ee19a83.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD57acec480d2e62d3ef6780218a5051f28
SHA1c66e522bab5316899e8127e39b478a4ed0305804
SHA25666c78b0b2ceac8879d6cd5cf4fbdb127ff3f1dd458dceaf6b9a2f251b1dd7641
SHA51211d4ec2c2dcf4914000ca87704fc96644488ba2828325bd78474917427cc17183878cb1e3dbdcbb3a428225f5dcabcd9cc5af172ea417198f84af2103fb93d3e
-
Filesize
204KB
MD56fd550d7fadbfd27d1e17ebb0c054f61
SHA136d096e86522ff7505b090f487c3fa3fee71061c
SHA25609ba40ee09ef75bd9dd7a2f4504563a6c377df10724ebca6e948c96ad3b66f1a
SHA51237e9bd3b1c1d2c0f068c34db0e8c13f80b51709e266edeeaa519d79a9516ee7d6b34c01f1870fcb5d771b76003d7105b5e69c3c0595dfd3ef7a60cbed69f961e
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB