Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-01-2025 11:18
General
-
Target
a1f61f346d6f8856bc883dbf9768a1f6d3c22a1408ad201db06c8518e28d482a.exe
-
Size
213KB
-
MD5
a34f70bb2344fd02b9d99a907653b97a
-
SHA1
9cb57b47b31c66467bcb53b2ba0997a3d7830df3
-
SHA256
a1f61f346d6f8856bc883dbf9768a1f6d3c22a1408ad201db06c8518e28d482a
-
SHA512
07f8f374431528dd56c948e3c1eb944dc34da13ccb8b2474b955114ce6f8bad9cc6a54ca0a89a8dd2716420817dc409d3f33c7b2bd8b1746add7edb81a8e024f
-
SSDEEP
6144:8QfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy6:rXkej+f4VDOEVdbgtf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1f61f346d6f8856bc883dbf9768a1f6d3c22a1408ad201db06c8518e28d482a.exe"C:\Users\Admin\AppData\Local\Temp\a1f61f346d6f8856bc883dbf9768a1f6d3c22a1408ad201db06c8518e28d482a.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
24KB
MD5cd6804d221ed639d32868ca09557d286
SHA1bfada5957140c1a43d9b51a9c22292520fbe3711
SHA25611378f204ceb75ee657cb01eb7d50ece08fb746e86c4b2f8790f049f5bd90743
SHA5124bd617003290642316ec8b5c8dbf9af62208c4a86517dc4fb524ca121ebb440263219c30c7360c3dd520c400b0fe5bb2cf5a108ed2ea0c73e1e5c156568191e7
-
Filesize
481B
MD5c54190d25bcbbd9a6c3a5f903bc2869b
SHA1931c7dde4ddaf019f101ccc9a929c73958cdfe88
SHA256611f7e201e64279ad6814d625e1f097521129a3e42aacd5e6b51680579347dbe
SHA5121eef030844913a82205dc1346a693bbec40d85a746d870bcbb15dc747bbcf1000c38cedb428577ef334f5c5ce28175b49f43fd4bdacf3c99c2ffc873a594d38c
-
Filesize
100KB
MD5fa56066b9f461045f84b89ca24562274
SHA12fdc1c9a4ad1d23ecb928ddb16661bfcd9e157f7
SHA256bb9c3cc0304bde504c1ba5830e830bfda6d9d55b4852526b826d97ea4ef8821c
SHA5126ed73a053e0f9a466a5c82466c49ba8db538a78874ab5cd782008a3d56b2c05cdab8133dae0b1ad0f1ae809e988cb096d2cfbafa9f79e8cea42e9b6cba7430bc
-
Filesize
100KB
MD50695def71de1947ce675d9f1a5721d1c
SHA1cd1b96735af4bc087c115f8cbbf6b90afd9e156f
SHA256e175013dc9ebf900591d86d8d36b5077664eac4bfd185614a964481e57b0b735
SHA512984adcbe3bb88dfd89a79cf41112ead1fa678c5e327ef0ec67ac085450a56f0d40fea8677438b38ec4d8a50e250f7f0735f47a5f079f738456252794015c6fce
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
213KB
MD5e47da6fb67b6da51a23628313a3c4b2f
SHA1bead154ff1b5b1d51caa8a02337d62ebf55cd7eb
SHA256ab39b1281ba4b4e7b08fb944b6d3f233246befd3037f518add59fa20c3f47bb1
SHA512cdfb4f84eb5d9260a097e31c4f7d6e8119e1b75e993d9abf6379e937a1433dc494c857773025222e5d4dd6bf080c9f865e7882fafce595be57c0dcf583f6a4ed
-
Filesize
380KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB