Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
25-01-2025 01:04
General
-
Target
69a6b092b83923d914f7ffe39cebee7c6d5133ef8a17c50a74c407ca8c405e8c.exe
-
Size
204KB
-
MD5
ffb27193559cc2024c581c418723cf19
-
SHA1
680d56970a4b03028451421fd1d1071293c1d287
-
SHA256
69a6b092b83923d914f7ffe39cebee7c6d5133ef8a17c50a74c407ca8c405e8c
-
SHA512
6d31808155d7eb221a7fdf7e2847194d37fdb0d5b18889d075428e6fac9369e2ad9d99dafa9ce5685143d81ac15f3a12911600c16a84f754f30ef7421ae3141e
-
SSDEEP
3072:d5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:dLexkuRaX41xoyJV65gzyZko+ucZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69a6b092b83923d914f7ffe39cebee7c6d5133ef8a17c50a74c407ca8c405e8c.exe"C:\Users\Admin\AppData\Local\Temp\69a6b092b83923d914f7ffe39cebee7c6d5133ef8a17c50a74c407ca8c405e8c.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5c9f55119ee949d4943828d124e803be6
SHA108f48b3ded1886879147e8b85372423a66e7f220
SHA256d6b16ee64a2689590adc33f470e5b44f9d2ec5a73c918db771d20d2a251d3698
SHA512e74caf16755f81db25343a0f1c798c9968b780c10225904209bafcf679a1f591257c01a25943459559f0457ff00bc98ce7b991434d98a121896406aaa7111fe5
-
Filesize
204KB
MD5db139e427a4be23c689ad46f4d02e6a0
SHA1fee44d7b08407ca6f8d741598563010f67c76148
SHA25625b653a845c1eb2608d608688413a7f20e0e451d0fd9f2478e054771b456e381
SHA5127da3c42776b923207f628a8ab8e3d06449c5565e9d69fdfa89282805ef16917a8c7bd83b66c6c641e730e4024671c8d29eb3a9e85640ff5de2c19cc4918fa305
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
1.5MB