Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
27/01/2025, 16:26
General
-
Target
c6fa74e2468e9f277eab1c0478e16ef924fadfbfcbab3adf1dd075c33fde93cfN.exe
-
Size
218KB
-
MD5
112ec944ca7b2d8f8d2bc95f62ae3770
-
SHA1
6ebd45a9a49ec91457776f18d732943cd3a1a5f0
-
SHA256
c6fa74e2468e9f277eab1c0478e16ef924fadfbfcbab3adf1dd075c33fde93cf
-
SHA512
4992dfdb88bb83300c8a61a5d61666484f4287080b10da192818024438ece39d41ae644f7d411da1158a97fc003667ddd2d30509366dae9fa1fc52e6f8617118
-
SSDEEP
3072:evm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:g1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6fa74e2468e9f277eab1c0478e16ef924fadfbfcbab3adf1dd075c33fde93cfN.exe"C:\Users\Admin\AppData\Local\Temp\c6fa74e2468e9f277eab1c0478e16ef924fadfbfcbab3adf1dd075c33fde93cfN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5c656ea0261c1abbbba26ec5d2806635d
SHA153ef97f803508044c9bac03525a33eb29fe6918b
SHA256d7a2b6ac219bd8a3e069cc1a9798688140014f0834649c2ba1d0f5dc2d65deb2
SHA51202942b6786ffb31d8821f2ed2c4249a07294d4b5566d33201a5688efb5823d27d724c4e5fa1575fb1717a0767a5941d5990644007dc9417a4bb494e47c28cac0
-
Filesize
218KB
MD5f7e6b183395a9a5ef5919edaba90f6b2
SHA12514b4df57c845ef5740107ce460cdddc6ebab28
SHA2561a5eaa51f592801661118d295bc7dc28803c4a9e9ac0b2dc93e5e5be1127529b
SHA512831b2033d3588c00b68cd68e2481df1ba323f792a40a5875d015ebbbe819e89a3489c0c0b467af4a23fd9e69b17757a9ae7d3f5f59ae9568161e4054d862f868
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB