Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-01-2025 06:18
General
-
Target
18df3acee4a0b243b46414d9d1f88e69bfd72678c91e951b95f7aae177d981e1N.exe
-
Size
208KB
-
MD5
9a43adbf180bdca3e12f8b68600c3130
-
SHA1
a40751d41973a42ff15b45356f028585c641ea44
-
SHA256
18df3acee4a0b243b46414d9d1f88e69bfd72678c91e951b95f7aae177d981e1
-
SHA512
42c08169e224d53d9cc54ed3c7d1879caa9c35945345e9de970dcd568f8f3e7be07c96132e00b511cdf23ee1d2e24150195da1365ae88d0f0310131ff942d429
-
SSDEEP
6144:za1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:zbapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\18df3acee4a0b243b46414d9d1f88e69bfd72678c91e951b95f7aae177d981e1N.exe"C:\Users\Admin\AppData\Local\Temp\18df3acee4a0b243b46414d9d1f88e69bfd72678c91e951b95f7aae177d981e1N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD541633a49127689029f5142e047a5b108
SHA176de44750f6c44f3f04035985a135d42b7951dc0
SHA256fde720eec8a0d0cc3c4324250c0dbfa2cd72e8c068ac264270cedfc1b60e0908
SHA5126621882abb00843b0d79c2a8c0df546ab844021363e01699f2555da312fa648a252355ce42de12788af5764516195cd4298856d6e891364ea4933ccb99b0abc7
-
Filesize
208KB
MD5efefec6cbaa2d98f298fd134415e1e6f
SHA149e99e5e32ad95d20462ab0f68a3eefc77525b84
SHA256972295809e7d02429ac345191a42f5be8cc3a56a50c9a0242b9f382b5a179973
SHA512091b8507b3653564fea9a369d25bcce915f0b2e5b2fc6a35f881f8e77fa8ff8cfc6c8da71d02277ee360b2b4002ba4b34354fd0e44f6d423eac41777419211bb
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
412KB