Analysis
-
max time kernel
116s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-01-2025 00:35
General
-
Target
7e7ae9956e65e5365d3e8cff9819649970fb410f95602690521c27fba4c2ebf4N.exe
-
Size
208KB
-
MD5
e677025886c82a40d04961cc9b8a7840
-
SHA1
5729414d5c4e31726d48f30c10bb9b0dd9b0c8cf
-
SHA256
7e7ae9956e65e5365d3e8cff9819649970fb410f95602690521c27fba4c2ebf4
-
SHA512
d9042f19e673fa31eb0c9ea128e53a1d4e475c1c9907ae26e5829f060f1def0ec4e53e0b2c3ce95e680b9ac68b500e21f1bf7b008a20cc9eca5f091a4deaf220
-
SSDEEP
6144:mJRDxRqdSqQts6iRZsTZuDbhivDVDN8zqF3:mcjQKUZigDVJ5
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e7ae9956e65e5365d3e8cff9819649970fb410f95602690521c27fba4c2ebf4N.exe"C:\Users\Admin\AppData\Local\Temp\7e7ae9956e65e5365d3e8cff9819649970fb410f95602690521c27fba4c2ebf4N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5a223f4e5eba6e801f8c6e7ce644cd133
SHA11bc1b3134a8955be760d953ef91fdba301519046
SHA2567095317ef033e2552aa0d4d3e06a4e33bdbcd71b2c02f8f991f81f5fb9363644
SHA512ed99419f5f30b95e4d32b741ae9e19de936f8cdc1e7e429c34ed6681ef34f7c4e5510409b7136f5d517767e35a211b37c239aca08f5350d2efdd1c7560ecc2fc
-
Filesize
208KB
MD57cf524bb976be14188a6d0092f1df946
SHA1989b3ba8a371ff670f2c3ddb2ac288eee41129cb
SHA25646eebc8b5b592e8465419b0532a5cf15a47217f693818a192cac463ee6cb9649
SHA51269c22f6c906ca9827e0334bc7891e7fc23f9ef13f4c431d0a90dbd8d4badf5db1047e514a5c794638c4554a58bb899f20e8b755157e432dbe5eabc5f2a84dee7
-
Filesize
324KB
-
Filesize
964KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
964KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
964KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
964KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
964KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
964KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB