Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/01/2025, 21:30
General
-
Target
cc4095314588737d0003f6acfffb9ecf528f6a6d5d3a4dc0ca38b16b77bda251N.exe
-
Size
218KB
-
MD5
eb1c81b88b53a98da20f3a8e10c28c20
-
SHA1
b8a79644e038d0aaa398b59885c22a97bcb04c40
-
SHA256
cc4095314588737d0003f6acfffb9ecf528f6a6d5d3a4dc0ca38b16b77bda251
-
SHA512
5a605de7a656597d1f0a98bf468352bcfce731ce19fa77d535c4d180531b8fd521ac5b0524dda4e6b01247d3ef89174aedf92279a5727df1b4aa614dc73a5c62
-
SSDEEP
6144:cEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:cEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc4095314588737d0003f6acfffb9ecf528f6a6d5d3a4dc0ca38b16b77bda251N.exe"C:\Users\Admin\AppData\Local\Temp\cc4095314588737d0003f6acfffb9ecf528f6a6d5d3a4dc0ca38b16b77bda251N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD54d1ef725a9e5bfd8cd4db1187e1fcdc8
SHA14100a0df0ce6bb8cf5678e154282cd0d7c8a7088
SHA256b75b06075d4e8afdbf000606ed9c6c4534612a8d206e379aaca69981a272a65d
SHA5126a370211cf00df9a7ee9aa4fdc0f7684ed7d572021f756327643aa0f22d03929759de4a69f61bc736afee3c6099612ca401446d825b6248d84a5cfd8f79e37b7
-
Filesize
218KB
MD590b8f0c582468d663be7ec59f5979c7e
SHA1a5cd3815ea380d6c43e2f72f5bf152c7f8ef28e7
SHA256802583c08383d0752899e9889f5dee265639fc4571af09832a2842bbfb0c6d8f
SHA512151f4c467e50e67e5f879f30a89114a2cf628f07560a9b352be6b3000cd010371a9c8b2b34f48703ca10102ab10986704c383d37f11171ab76242813179f7ad5
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB