Analysis
-
max time kernel
111s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/01/2025, 10:22
General
-
Target
6a4448018ad84df8a5aec18ecb26f1155331d29384c42804d282558651f5ecd3N.exe
-
Size
218KB
-
MD5
7e043d781e18dff9f08c46ade0fd6580
-
SHA1
93d89298dec6e1cba06c59bc5a37e61b46f190c3
-
SHA256
6a4448018ad84df8a5aec18ecb26f1155331d29384c42804d282558651f5ecd3
-
SHA512
7b04a0713e343e84975cf52f2759ecf7297336c249f68556f4afe77ea79776e767266b7afc3fcc98cdf1dc4adfb7c11d851e3cc9b17c17130d23171adbee6722
-
SSDEEP
6144:dEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:dEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a4448018ad84df8a5aec18ecb26f1155331d29384c42804d282558651f5ecd3N.exe"C:\Users\Admin\AppData\Local\Temp\6a4448018ad84df8a5aec18ecb26f1155331d29384c42804d282558651f5ecd3N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD58f9a938c595eeb5781685488b4c477c5
SHA1b271e3be51e54bae0344ada76486a7d06f0866b7
SHA2560f716a23f5ef021d5bb47df8e8bfb2e867221095c4d3fe4d436f68689008fb8f
SHA512045997b4accf82a17ab0a6e5ea73b72a3b60c75f8cd8f3fa71020762427a854b73873bcb846c7e21b31975661356fc554e4e8001c7a6d82e932dba866c9da8f8
-
Filesize
218KB
MD5b73dde4d42657ff51217f975fcdd5fa4
SHA12185e44c861f4fba113e5dc9f4590387b1b1c88b
SHA25664a1b34fd8647752c468ed2082869ea5c1d17930e4de06fd848a6ff213601ea4
SHA5120804339a3850506ce251e6c29a1895ded728bb0e8874037f321040142adff1557618d10dc00c87d337f23cee425d7908ecb351c25d27dd69ed91c8f12bdf7fa6
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
2.8MB