Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-01-2025 19:55
General
-
Target
0e1f8a154de01cd93e70c8480dc6291c2723db4182a59efa2249b6a96fbb03d1.exe
-
Size
213KB
-
MD5
05755fef89302b74636f4723bc2be86d
-
SHA1
10b498402e927eeea46ab2dbce80a15d915be419
-
SHA256
0e1f8a154de01cd93e70c8480dc6291c2723db4182a59efa2249b6a96fbb03d1
-
SHA512
886a99d1e52840fca02fffbb8dc892e4643dbac19c4a45a7d4823a719f75fb20190bf4cefa3b242340be3f049828c9373b0efc57fbca4e3156d807de3b8a816b
-
SSDEEP
6144:yQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy:hXkej+f4VDOEVdbgt
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e1f8a154de01cd93e70c8480dc6291c2723db4182a59efa2249b6a96fbb03d1.exe"C:\Users\Admin\AppData\Local\Temp\0e1f8a154de01cd93e70c8480dc6291c2723db4182a59efa2249b6a96fbb03d1.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD551058358e943f4a025b1b7314182e60e
SHA16d1bc29efdb1348af6b0237df2b2dc1dfbcf685d
SHA2566ace7cbfed88f1cb2c29b6729d6a7c5b12a686076a3df8742a6bee4a67e98c3f
SHA5129c07534230293d84a7e8f0a0d212eec8dadafe4dd51f63f01674d2333872db22fa69b6d4da98b1b001f96a00885bab0aabf26c5fdc57f16693d0aeddbd4d59ea
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
213KB
MD51448a8412ee0c130a8a4872168a44402
SHA1cf3e0ddd57182e02ab2563fcc6bf9529441cd958
SHA25640cbda8760580ffdc42d434b4262d019dfbb7e0b15964a08c29135ebfbb637aa
SHA51212dcdaf8a731c240b0bc0701f8f5be6dec4e1d63325c83c29f93f9cf8d195ffa8df63d49a6e7bf27e772133629fb37fc43711611005ec0a918e945deefe1a835
-
Filesize
2.3MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.3MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB