Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05/02/2025, 09:43
General
-
Target
e041aac61ecce5ddeb55b2ab9b54efe700fbfeadbe7fabae30044483b9948f33N.exe
-
Size
375KB
-
MD5
201cd721df3a006824d99e96759e9680
-
SHA1
267a5c3a87bf588762ee1f8b128d7672e840eb54
-
SHA256
e041aac61ecce5ddeb55b2ab9b54efe700fbfeadbe7fabae30044483b9948f33
-
SHA512
9cd594c29b515563b78f50c5e96a7ea83a80aa412d1213335c98c7e9e829d874f7859674ea4c93d0a650c6cd29d060354a3d15b2db8ebdf4563d324f3d085c73
-
SSDEEP
6144:q3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:1mWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e041aac61ecce5ddeb55b2ab9b54efe700fbfeadbe7fabae30044483b9948f33N.exe"C:\Users\Admin\AppData\Local\Temp\e041aac61ecce5ddeb55b2ab9b54efe700fbfeadbe7fabae30044483b9948f33N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD53b6a4beddf630abdc3856f5b255344ff
SHA122b3c01fd0e45e1c33cf6ca4ab76cf9ea76ec5d6
SHA25684793588bdbeba7ee6a085e966433502cf301eee68db1f5fcb950297653b04d8
SHA5121ae3b41fed5aacb9493624ec8dac18907917f383ad9be9fd3e81139631bd3d39facd22d5d2be8a158e7967298442031e17a6933c449a931e295c8f8b416679e6
-
Filesize
375KB
MD51d7fe631d4f4626b77002b52f5a93df3
SHA1d76eb8af88ce1c4a20eb618eb4e8a5fc8fd55f06
SHA256861ac6dc445644d7e63c0eb3316fdc7206bb800490f7d78131d7774cf4bcd31d
SHA512ab80bfff18c473441dad42333aa7706349e57153cc86793e8e3073d0d34feb691fcd6e90a5266998716e98efeee1052d45f4d8d341463613daa88921b87fc6cc
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB