Analysis
-
max time kernel
114s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
23-01-2025 21:27
General
-
Target
056661def72ea7ce96f62d7a1c83aaf66964e1746af6ca8b5d0b360cf6f7ce1c.exe
-
Size
686KB
-
MD5
6e07bd3860a7e33a2050592dba01f45a
-
SHA1
2a6bc788786073c96889ec7b536fcde538b7346a
-
SHA256
056661def72ea7ce96f62d7a1c83aaf66964e1746af6ca8b5d0b360cf6f7ce1c
-
SHA512
d8d3a45d2ac19a44b98146866ec994f244d40c21d9d2e6f6592d05e6e0f15706abc2b3a5aadeb2ad7800205ac07c9bb1c888dbd27c09e349353c1896437b4e83
-
SSDEEP
12288:9mWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgpF:9mUNJyJqb1FcMap2ATT5itjCYZ3DSoF
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\056661def72ea7ce96f62d7a1c83aaf66964e1746af6ca8b5d0b360cf6f7ce1c.exe"C:\Users\Admin\AppData\Local\Temp\056661def72ea7ce96f62d7a1c83aaf66964e1746af6ca8b5d0b360cf6f7ce1c.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD51e3839276c9eeb6d1d7c43dc26fb6bca
SHA1f706031324e475096cb755f7d68ab9eef3494e6f
SHA256c70a6edbafd175bb692654f923a6ea8061fea9d16e2b08f25b9c398e5129f5e6
SHA512c4d7197c810957519d10ee4fde9b3cace72de003fdc7e034bf4af6cfd4c42135563f9ec2c00ae75f4b1241ee46be23a9c87cf5b5dd76cf93c58a63b9ff8060cb
-
Filesize
686KB
MD5eb497e9eff1428b0a47e70fa50904274
SHA1fb103f15310120b28cad27a1932306a86408f473
SHA25652ef187f0b29619d37729876e2b07bbca1f57ddf0d46b3b8a287d1ac00d26d1a
SHA512778dbd19c1fa87a029716c35db57af3c6939cd63723c6320773a451f91635b1810419f0c3938650170fecb8af1b90d44be8c4005f55f359f95a71ddbe59f439b
-
Filesize
732KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB