Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28/01/2025, 00:46
General
-
Target
8e1255aa6b06ca50201b6b10f6bf105a81bf20d74f62511300f89183686fd608.exe
-
Size
1.0MB
-
MD5
83bfe36653fcdce0f3ff8bd94b5441fe
-
SHA1
69f540120cbf37b991da6be42ede3bfa5fd9fa6f
-
SHA256
8e1255aa6b06ca50201b6b10f6bf105a81bf20d74f62511300f89183686fd608
-
SHA512
97fecdbea703ceaa7a8c6c4b1b3754a2c3c8dd1a7c70cfc1d48abef1feb28ecf72cf4c468a923c0344d4f2de36d8dc7339da6d520f22ee27be74c0436eadff11
-
SSDEEP
24576:nmUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT58:nmV2ApemV2ApemV2Ap8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e1255aa6b06ca50201b6b10f6bf105a81bf20d74f62511300f89183686fd608.exe"C:\Users\Admin\AppData\Local\Temp\8e1255aa6b06ca50201b6b10f6bf105a81bf20d74f62511300f89183686fd608.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5051952c9b13a2dde55c4ef3fc4ee6016
SHA1506159714483bc9df73ca8671933e22a86fc4d86
SHA2564bce8eb44665531d777d5bed27e4f90f74abdaf98dbe91cf5d99cc12bd223d33
SHA512dfd7747612a333036729796e9d667aa97443a9439bee1ae25b3046843b7ee840edab2fb43a382d3a33afc224da9b54e49cc513ae30b4bd134c9b57a571300f5a
-
Filesize
1.0MB
MD56322960868378dd0b6dfd06343463e25
SHA1e384450042b51bfc83d97910fd70d6bf7b024dfb
SHA256abd1fe0a11be71487e0f5fee47ae81da35db4c4df18dc5c47b0009ebc57178dc
SHA5125454eb9c8b329114ebd582d37f6039f195bf8b18fda4de69a501a3c5feb9a470896c3672c54d5e3901b0b2b709f18ea314c25794266586d31c9ba164e88ac2bb
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB