Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21-01-2025 05:48
General
-
Target
869264b018a906bdf186b8ae9d0e652c14363ffbd52729dc753e602b010010f2.exe
-
Size
218KB
-
MD5
9df715f2da4904c6821f1374d09d7072
-
SHA1
8ff19bbaff517979e02c4013afed7c251c2dcefb
-
SHA256
869264b018a906bdf186b8ae9d0e652c14363ffbd52729dc753e602b010010f2
-
SHA512
09caa7e423b3be0bbeeea261a255c38c9e83eddc0900f6e005ea00b945cbc5c548f13fa08462b177b87e05eadcc38795c05046d502af9ee649110867218e19ee
-
SSDEEP
3072:/vm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:X1SyAJp6rjn1gOObn4b6h9B
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\869264b018a906bdf186b8ae9d0e652c14363ffbd52729dc753e602b010010f2.exe"C:\Users\Admin\AppData\Local\Temp\869264b018a906bdf186b8ae9d0e652c14363ffbd52729dc753e602b010010f2.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD56319293e4628b198026589cf0e5967ee
SHA1286554b0f289c6a7abf5c0b1c078638eda967563
SHA256a9f9c40b55947adb2894c234ed0d20c9d6264de4e4b7e55d61cad7c3b0ff426a
SHA5120952e5f4b3eaa46fd2ba2e4d5989ecb176fb563dfa2092fdc5443557731534a78e4f80b69e57d80479e74ceddf83877d29a8eef750193fe05e5fd9e0e45a586b
-
Filesize
218KB
MD53325f60b350b9825cd0bc862d82006de
SHA103877d1cfd7cfdeeb72f3cbb3361156f67fc2fb1
SHA2569e4bef46beb7acc6a50d9da1fc35f18500eb4155991b21fb92687e9880707bc3
SHA512d1f2ef22fe34f9c2f33c546d47be50148dc6a48deff45475535ea2f596d1a265d56c83496651cbefc1bd533978f63fe4642ca33160265914f342e7c1cc515ded
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB