Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-02-2025 22:39
General
-
Target
454cba8b75d44c489fb4ac8bfce4ecb83359894d1b56c90c2fab321daaa484f8.exe
-
Size
218KB
-
MD5
2f15a47f640e3a3ed8a5ac10650a72e3
-
SHA1
91a10b0d6f6958da163480e737b8df058af3097f
-
SHA256
454cba8b75d44c489fb4ac8bfce4ecb83359894d1b56c90c2fab321daaa484f8
-
SHA512
a48ce456462eb5d88aa30ecc4d5cd5a692a430b740b53f5b947d7f236be6144c4380a43036df53f6dc474d7ceeeff6080b5db962524c23e4b7a56aa5608938bd
-
SSDEEP
6144:BEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:BEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\454cba8b75d44c489fb4ac8bfce4ecb83359894d1b56c90c2fab321daaa484f8.exe"C:\Users\Admin\AppData\Local\Temp\454cba8b75d44c489fb4ac8bfce4ecb83359894d1b56c90c2fab321daaa484f8.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5642f831e573a7c7ebfd114b3cd1ab84d
SHA1e65ec5a1d887cc69af3062fcc78410f9d3d31236
SHA256f11d49cdd7c0df1143bd784e425076b94f3ad75834bd93ac60fc4f130a09caf5
SHA512f967e07fe22d2e7948a39e3a04c2e2358d3df09af817fb0355627c9ead0eef008816ef470115ab154eb5a898c7c8f58b6fb8a9ff22409104ce45524edced4f24
-
Filesize
218KB
MD5552d5a21e80fddd98182d9703a78ab22
SHA103d6c2776146fcf683374875ac418ac2fb74057c
SHA256f3bb6cc4ee9c01a69ba53f50835e180f52b93bbbdd91f1458e569400dc3f03c7
SHA512404ab4c742b3e6d14bd4f751d4ebce3f4d8a7e7b36558d7adf202dde17a513e196af42a8b899712c510320c982b447a1d4e3156fc46bac90dd01c750c0b93da4
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB