Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
23-01-2025 00:45
General
-
Target
e4507790c4ba961ff843cfa7eff830832ee3c1166c6cdd9817c91c61ee0e7369.exe
-
Size
218KB
-
MD5
0a6b2d129bc4f30ac51335439b552189
-
SHA1
74c32723fe8988aab6d90e7f45e5de8172dd3a92
-
SHA256
e4507790c4ba961ff843cfa7eff830832ee3c1166c6cdd9817c91c61ee0e7369
-
SHA512
d19b678ff4281d1b1111fc5c887095f067944387575693a5ba2cde48c592aecee90036da12d306f56e2772a11f3b198228c6cbdb32b321d5a2a1d82356603743
-
SSDEEP
3072:tvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2HK:h1SyAJp6rjn1gOObn4b6h95
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4507790c4ba961ff843cfa7eff830832ee3c1166c6cdd9817c91c61ee0e7369.exe"C:\Users\Admin\AppData\Local\Temp\e4507790c4ba961ff843cfa7eff830832ee3c1166c6cdd9817c91c61ee0e7369.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
24KB
MD5307b734006c86a3b94d41c5bbdc794e8
SHA10581243b9670c0e888345ac109ddc332b6d4c0c5
SHA256a014b8568188f2afd5c57bb73408d73e46894e81e22c6116e67e9380eb42528e
SHA512d91ced8ee86b30c59999ad329658bb64bcb2f6670cf50ff6862f08a38b06c573f57b00f53e7f480b4f347817f0945764220822abf4406e1cdba346ac330c9e92
-
Filesize
481B
MD5fba4472b2e30c606207d7713f3958bcf
SHA11367f3d4cf5c7bea89da0dfef662a0603263146b
SHA256e109583bcfd4877744fd3d1f5f2be1152ebce7edc5b893034ccefee639beb6b7
SHA512d6302de203fb218d2af891e7f637c192784b964eb38b53dc9e8c1285f507fa55199687cdc3f48991a7de856e68660a9a30264d3e2a8688e291b84916aaf702fb
-
Filesize
218KB
MD585f28f58a2d5cd2b44138a9c18c534f7
SHA18667706ca9af67b7aeeaa63c69d530e07ea33bbe
SHA256dd08a0646f67b05fc36ab0942efd1a2249edcc948922bb3b7ff3ebc50a2b4ba7
SHA512da2a56b14b6baa503471f6a15f729776a693a5fbf7ea8e3a315352ff791322bd39895f5b511cdf77802d0ca69711d10247d1671caed33c62227fc0447550b622
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB