Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
20-01-2025 14:01
General
-
Target
6ebbeb9b18aea982cb23ac6edac3f678417436e9757526faaab85b4ddd2e9b1cN.exe
-
Size
218KB
-
MD5
94ee161e4486476e0b4b62bbada90bc0
-
SHA1
d0ea99ce63c36de5143a966bd7668c6fffc451e5
-
SHA256
6ebbeb9b18aea982cb23ac6edac3f678417436e9757526faaab85b4ddd2e9b1c
-
SHA512
53561d5e087c0754731731b4156fed8efb666d33bf8d7b803b03edfe26b33b9f19fcbfad0c163a4c193576fc41f221cb32a9976c87c1cf69e20ebd9363f63be6
-
SSDEEP
3072:Lvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:T1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ebbeb9b18aea982cb23ac6edac3f678417436e9757526faaab85b4ddd2e9b1cN.exe"C:\Users\Admin\AppData\Local\Temp\6ebbeb9b18aea982cb23ac6edac3f678417436e9757526faaab85b4ddd2e9b1cN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5403c073cfb1bb5d2646719dfac08e306
SHA1c14d497b4eb85aff2068bad573f8e8a84944723a
SHA2567f0fbb70f7c174fc3311092fa0f2e1c15f133d6df1eae9ce2a3feae6c614c6c2
SHA512970e0fae4f24c2e55ae486b93a0d687b9243e7841588d52d657be130ba72bad43821ebc31097d4c57b84da4ce73d5ca426cdf9ecd2c360dd9085bf7d54a79b15
-
Filesize
218KB
MD5786f470b7791ddc90590492d7466e88e
SHA149e7771d3207b8f84fa496e50e508e76b521d899
SHA256c777aaf696602d50e343ba585973cd96b854a297f658e22b196c106226be008d
SHA5126d36d8c3d5fd102c28ed8a864c562c4a3da8c47f64fc830c59ae90bc0d65c7415af3fa5bad68957605cad3e39db9059467d7482a7a09a8a2047a898eb808c28d
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.7MB