Analysis
-
max time kernel
115s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-01-2025 09:26
General
-
Target
308ed72b9383db589d12bbbda21cd2ec8baead48b108c82c5eb3163195469550N.exe
-
Size
208KB
-
MD5
66086ab47339255a7273e80d6acdba20
-
SHA1
b11452b4604e31a77718006680a228e904f39765
-
SHA256
308ed72b9383db589d12bbbda21cd2ec8baead48b108c82c5eb3163195469550
-
SHA512
a099011738f0412c0159b0e78944ee885ca1cc7dd1b2abf6b6349227be83eef27d0e460d902d4c54031559835c9ae90083d53980f18d28bd202604d93344a9f1
-
SSDEEP
6144:Ga1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkw:GbapK0JCmRcU9vVokfD
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\308ed72b9383db589d12bbbda21cd2ec8baead48b108c82c5eb3163195469550N.exe"C:\Users\Admin\AppData\Local\Temp\308ed72b9383db589d12bbbda21cd2ec8baead48b108c82c5eb3163195469550N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD52fc222da04971ce2f4fc028bab8bce48
SHA12707773a84e1113ff420741047400df1a2f1a538
SHA256a36f7339a2035ab9edf10606745ee47669689fc4e774872280dfbce50bc92345
SHA512ef4a2b3f5ad4b4a511a3784df8ffbb85a555a88e7f29a153fa292b14cb09f9b7188b93af38d41e999f8330c08e677ebdfd884db5b90a0fa8dd465a392fce4616
-
Filesize
208KB
MD5f0ded6c0e6d7fe7856bb721af2b4b493
SHA1dfe2b40a064d7699ad36532ccfcb63dac8719b83
SHA256612a652dab1ee9b22bee974e0cef2fc02af447866bd2b5bca39246cd069efd6a
SHA512ad4a356d66fa802616c1a1828722606a6121bfdac78aea0f4603f25142d772bd0f50933cd7f7b379ecb28db78dd619df80824ef264d3746459551df56a59742b
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB