Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16/02/2025, 10:07
General
-
Target
55f690964ca5f400e7144002550cb3ef2cb00a0372319b03d7ecdfa7c8bd0295N.exe
-
Size
204KB
-
MD5
57756f480f4971db3eeb0325045d6760
-
SHA1
5c6766e8124eff43b34eab27bd1fdb23b489e98f
-
SHA256
55f690964ca5f400e7144002550cb3ef2cb00a0372319b03d7ecdfa7c8bd0295
-
SHA512
50d84ee7050cd8ac62fa7d32b6bca54058d8b575dbf73b34b08a53633c548597c5e8324465371a03d6ba37e77f40f28bf7cf8f8ce203c8a9e4cc8b4bee1e4b46
-
SSDEEP
3072:F5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:FLexkuRaX41xoyJV65gzyZko+ucR
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55f690964ca5f400e7144002550cb3ef2cb00a0372319b03d7ecdfa7c8bd0295N.exe"C:\Users\Admin\AppData\Local\Temp\55f690964ca5f400e7144002550cb3ef2cb00a0372319b03d7ecdfa7c8bd0295N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5f10078a660f196bd3cebf12bc7e8fc53
SHA1401411eea9e4cfc0f2d76275279423353a78659e
SHA2561ec8b2800cea5a6de50c9230c6b08498c9da0d79855bd57c8d0165a61b385210
SHA5123f13aa5db5e99012fe0392c7a60a6dad82b369515d8afcb66dd490c401eff21d60ecffe0721f4d170747dda38a8b0a5d80272d4447aeff0611c28867d7187c04
-
Filesize
204KB
MD58e429ed2a12ce2f4fb66c41e5ccdfc49
SHA1256b163da59fc64dab9f7606a084f6719c5f7198
SHA2564ef09be727e9955e5eceb07f5f2cd3ecfabf795e2982a8cefb4d2390abf95754
SHA512b06e255f30f8b52328e2b84e01407f289826deebca11241043f27e9590214063524b54b2a8c40ce53781064cea207e608d969b31d40a0f198fcf19a43b2bb17e
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
1.5MB