Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-01-2025 01:42
General
-
Target
05ae6e9bcdeb62392af85fddb75b074f180c0e51b29dfa834f14235d1c3cdbf0.exe
-
Size
686KB
-
MD5
b20af44b22723240b43ca867891319dd
-
SHA1
6a590c494349cea8aee95cac07f8f5355c2c0375
-
SHA256
05ae6e9bcdeb62392af85fddb75b074f180c0e51b29dfa834f14235d1c3cdbf0
-
SHA512
5c4a3d5aaf12f62d57610642802170f1dc3b9ab9f00001b3e903bf2b1c3a3331bcb6b9cb27491dc7bedbd9d2323d8ed4a4f484de1caa7177e7ff093ae82f3df8
-
SSDEEP
12288:WmWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgpt:WmUNJyJqb1FcMap2ATT5itjCYZ3DSot
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\05ae6e9bcdeb62392af85fddb75b074f180c0e51b29dfa834f14235d1c3cdbf0.exe"C:\Users\Admin\AppData\Local\Temp\05ae6e9bcdeb62392af85fddb75b074f180c0e51b29dfa834f14235d1c3cdbf0.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD570f4394193e1838f9a7ac567dedefbfd
SHA1d0a9a1f467ea2ac1b94834397d68e0233a42ed55
SHA25667359961416176d0b100e72816c95e464c0a511c88547de90deb673fed5f6766
SHA5129c250e074dba0f46b1b7862ff22dc866e30f13f502f29ced922b40058515a10f2c5eccbf54c38ff212a86d858ec1aa08a89d5e862ed10f783dd82e4fe09303b7
-
Filesize
686KB
MD548892017a313bdbfdc73329affc57389
SHA13448c103beaac2c7a3a128bde37e3f6f8cd25804
SHA25699537a74e67f5cd2ff3ae2dac3466be7a0e7cd46fbd3f2a78580565f4f647769
SHA5123f45f7049c5a55e3ff073d6b7ca4ce38355f26cbc6db9d048193ebe2593983fc2946d065fed119ef037b03c2c4f0c9b3216b2b7964524ca64d35146046741795
-
Filesize
732KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB