Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20/02/2025, 01:26
General
-
Target
6d2d4132fb501bf89d6148ec031cf4152c7a08c1e3adcd8f8a68cf152f287b9f.exe
-
Size
208KB
-
MD5
e0dcf9942e0239e5465ebf1a1195968e
-
SHA1
f7e524c9aa197ab66c31ffd37293a82019425774
-
SHA256
6d2d4132fb501bf89d6148ec031cf4152c7a08c1e3adcd8f8a68cf152f287b9f
-
SHA512
f8a1d559a36b93b61710fc17adeeb5880031cc8e6e7852dc31215f4d94f481b5348e6882a263996df5999d2441dc8534c74ba0dfb2e0fdc2a3f00a097cc0d1b0
-
SSDEEP
6144:sa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkw:sbapK0JCmRcU9vVokfD
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d2d4132fb501bf89d6148ec031cf4152c7a08c1e3adcd8f8a68cf152f287b9f.exe"C:\Users\Admin\AppData\Local\Temp\6d2d4132fb501bf89d6148ec031cf4152c7a08c1e3adcd8f8a68cf152f287b9f.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD5adc9a67346c94cc95ab0f12bf4756834
SHA1646ede7955bc89ac30eae302b71bbbcfb1d40ea8
SHA2563281661d5f3a191983c5a9cf932cfe4616125f5baa95b471a4c3a225ec7e0fee
SHA5126affcb67331922bc122dc5cf9e58a20dfbf36ddb1f4efd58af0f7845c24fdf7a85da818fddd3c620aa94fa4684598b867843b132cdb520cc9580bcee42fdc45f
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB