Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-01-2025 21:36
General
-
Target
04e45f558869590927ff9351519f3589f3d06856376e274e708d78e434caca47.exe
-
Size
213KB
-
MD5
3f3b2748c4eecd51d87187343458662d
-
SHA1
09a6d086deb806bb11e595c44d9d2c922594af90
-
SHA256
04e45f558869590927ff9351519f3589f3d06856376e274e708d78e434caca47
-
SHA512
cda8db4aae7d20edc5f6eaa620c912b6ce6b823b8b8069da648f8f09e4a3428f0d2be44b8ebc84466999e020764868f970a44de39cad97502305cafc88449242
-
SSDEEP
6144:oQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy6:3Xkej+f4VDOEVdbgt/
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\04e45f558869590927ff9351519f3589f3d06856376e274e708d78e434caca47.exe"C:\Users\Admin\AppData\Local\Temp\04e45f558869590927ff9351519f3589f3d06856376e274e708d78e434caca47.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5020ba3cfd868c52f197f3e054c13f0dd
SHA13f888970efdc6c845b72f2ffbfb7e3f4029f3089
SHA256107a96c5650bc06fc1e878c886157fe29284d3255d6aa7974d8c6168b8f6ab87
SHA51280d5054a1f42529ea534ac1c2cedb74211c79748c99e0a29409f90ab2eaadb3da2481631a7c8d6a78646c8cb1f48fa6abcec911cdbbc95f3c7e57a42225d9a48
-
Filesize
481B
MD5153f27056ff01796eb6a11efe84b6a27
SHA157f386a549f7f497476bee94e9ff52fc29a1cc30
SHA2568fbde4cb23d2e42aae72d3afb5ca1f1aeb3b5b07357c9093882bdd08e442e0a3
SHA512d8b5bb644b44b0b008f399c0d512ef2bbb83f6c717cbddb5fadfa0a202b01c7f9b245552f61b59455d6214b94c2abb6f749309b2f11864657b6935328fb91d9b
-
Filesize
213KB
MD51e41e02bfbefb15dc0d97074eb602dde
SHA171269b1c100cb2e64438f297cee742b71239aebf
SHA2564da278408f3716beceed7a44d83ee4bd12a285d83e3584e9f63e24373932e8b8
SHA5125056bf52b7b845477f8f5b824e08da79d822f11fd7e5bd298628f1dd7aed581c129063f01ff1a2b66faae11bd2a10d0917566206ed6e824144f74f3f9943607c
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.3MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
324KB