Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18/01/2025, 06:21
General
-
Target
94576fc100985a117b1fd642453c546f8cd7ef962d0fd5758d5ddfeb2097baf8.exe
-
Size
355KB
-
MD5
003eea5e06158cf2200efabc4b490117
-
SHA1
760ab8f9c9a9c2166cb5314395ee3f94235b6015
-
SHA256
94576fc100985a117b1fd642453c546f8cd7ef962d0fd5758d5ddfeb2097baf8
-
SHA512
67fb58f081d0ebbcc8b57ebd2e5b218264d8b5e6aa19492511408344f5483d3a6f6a434351057f492110c7262883e277193c7be4d7571731dec554dcc76d9990
-
SSDEEP
6144:VgEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei:TmWhND9yJz+b1FcMLmp2ATTSsd
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\94576fc100985a117b1fd642453c546f8cd7ef962d0fd5758d5ddfeb2097baf8.exe"C:\Users\Admin\AppData\Local\Temp\94576fc100985a117b1fd642453c546f8cd7ef962d0fd5758d5ddfeb2097baf8.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD531481d780c6c37a9e612bb613d8384da
SHA14764bc9a4368cc42eeb2f390cb0d776346f47fde
SHA256fd9db0dc45d73bc82dd1b5fb103825c557104886be19336154bf6dea868ddb21
SHA512eec2479ce109304daa7d8a4d59d790a8e61077ef7a590989a79467292c7af24ab1e32b7e575a3697491449af1893ed6e285ea9a8ce39488f5956bc7a00a2bb31
-
Filesize
42KB
MD561a8ec157cb5b6c32b1752bed0d66991
SHA173e228c3f5df0dc7640a476027dc4c0a0a3513b7
SHA256a08315f34d5d63e4fb821092e7cda06743d2a9f4029716f4e3e0caa34af88dd8
SHA512496315c014cd2e38f962d7a35c6f6d88364f9dc9d63745d62dd2198e9f4faed034d797ebb5c0404563ebba22e8976277328ec878044da9e6cb27aec30e150935
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
355KB
MD59be611bd80f8c38f53f2755716fd5caf
SHA1f8590c50906a9d0136e5dd201876e644fea0f30f
SHA2569462b0a53c06f7ac685a0d5b7b9e37479a55a52c389f655d7a037690c5573daa
SHA512b29514e2614a2614942612ec086034ef1262c62f083220257b38431bbf7ab7dd6c051e78efebf0e04b30b60d778bfdebe346ad3205dff2e51a4c65d68087f642
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB