Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-01-2025 03:31
General
-
Target
996f9f0bde22728b52ba22cce12757e2e81ad5c144137efe82f31e8cde40d5e4N.exe
-
Size
208KB
-
MD5
d0b710f99d0cdef0d1dd367257238cc0
-
SHA1
8a6d9f027a201558437ee370fa006d752ceaffab
-
SHA256
996f9f0bde22728b52ba22cce12757e2e81ad5c144137efe82f31e8cde40d5e4
-
SHA512
9669eba3ba598a9ec65d810b147fecc9d54646c7cc8df2b1980636b57b3185fa708595af49ae4082cd55309f5c241ce49739cf2e3bd5190acaf9715db682495d
-
SSDEEP
6144:ya1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:ybapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\996f9f0bde22728b52ba22cce12757e2e81ad5c144137efe82f31e8cde40d5e4N.exe"C:\Users\Admin\AppData\Local\Temp\996f9f0bde22728b52ba22cce12757e2e81ad5c144137efe82f31e8cde40d5e4N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD58af4453b3c9de22b16fb18f7796b44cf
SHA1eee77c1eecaedcf699ec10129c34d7e304a55087
SHA2566c6b5cb86855d74651729e5559fbc25d8ad0f96f55a5ba337b363d8707fd3d3a
SHA5129c7ea42da76e2adc480a1c7aa55de0e5c510df069daabade1ebe3002a4e3cce1fe54889c5f763e91a408ee739f35cc14a278102609f5205d1b5b79a1724fbf59
-
Filesize
208KB
MD5f1fb91cfb298e7e1eb124e9a60bebcb5
SHA18b443ed0feaa4821984f40e75b1200425369cded
SHA256b490f864b325a493d411dcb2310fbb7e4040c6205987587de385167fa8cdd342
SHA51285fbc44c807cdb39af397c924f0f63a21c057179a32162e5ae3b75ddf9853196b3c212a0f62668125d0e81d2b335c95d21fe2baa954aefcd58df7440072af3a9
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB