Analysis
-
max time kernel
114s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/02/2025, 03:35
General
-
Target
48149e21993b54181c21a80ea1ab2a9ec8177e32ba4c63b5a4bb343612dec97fN.exe
-
Size
213KB
-
MD5
9d0be6718bf0dacb33c59f5a3a61fc90
-
SHA1
924e5f1d9e25ddd0755dd3e43f3d2f4ca019b0f0
-
SHA256
48149e21993b54181c21a80ea1ab2a9ec8177e32ba4c63b5a4bb343612dec97f
-
SHA512
9aa7e20a111e8cedfc5c8c8a2153fd248a76c7e5c12576b1e3a6aed3f4234785b638b7afeac6e63bd87f92b6cdde1d260069ae40dcf782c9ea26dcd8dafd9a69
-
SSDEEP
6144:OQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy:dXkej+f4VDOEVdbgt
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\48149e21993b54181c21a80ea1ab2a9ec8177e32ba4c63b5a4bb343612dec97fN.exe"C:\Users\Admin\AppData\Local\Temp\48149e21993b54181c21a80ea1ab2a9ec8177e32ba4c63b5a4bb343612dec97fN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5a09745748cb27fce323ae8b4be3dd4dd
SHA1bcf716699c876447cccfc3dd78ac613424cae62e
SHA2568fb4af1d9ffe220251709a6dd3c91338427277a0d7f0f4497f17f0ed1dccdde6
SHA512050625f6160e58e8c4f97521d0d2439634e15bfa7f5232bc5c99ebd5faee55a16aa8e3e3ee66411382b1e5e09d4134c80be3d39631f03d1c257fcf0830770f64
-
Filesize
481B
MD5652c8bd32db3d7489c11469c6fa76796
SHA18b4f2cd620bc2a25725db00c20682f22e033a475
SHA25601276a1844ab44985d17cb38f765814106ee694ce4c3f916939ad5fad132de5a
SHA512170b7efcaeb1407846a267f5b672a5656719881e2f2d876dcae93e114516e630fb2325042a9ea5df3c2300712851036e4f93b432e38253f1551c79ff892e7949
-
Filesize
213KB
MD511b63b40a3fff5b6569729e67fee971e
SHA14e30efc273241666dc0683781b14a93e9e5641fa
SHA25642e1f9f779c380a05ffc3dd3a7dad17f3fcc10c011325d8e2ea2620205545b56
SHA5121a06817bbe2524887e577f2006bb5e70f83c8624b002fcd3f32e772fe214c8c30a035cca1c2c0b0a8c51fb2c50556b59537ae02a8d92ab1a15efd3920e23995a
-
Filesize
2.3MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.3MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB