Analysis
-
max time kernel
134s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/02/2025, 02:35
General
-
Target
7487b4b9a07a4b63acbfd0015b07ce31e4beb71bc32ea1b897e3340b7de47247.exe
-
Size
686KB
-
MD5
cc84196d1c33109852dfa7a808cf7191
-
SHA1
1010f9d133fbbec51c48299a1cf23a7467cb6786
-
SHA256
7487b4b9a07a4b63acbfd0015b07ce31e4beb71bc32ea1b897e3340b7de47247
-
SHA512
7a2af8814c688d8087364d4928df3c8c055a389d55c9a3ed0e1e29e950e7cb4f89a41620c418c79c30335cc8f6cd30f34b122c1ed54d6e95d8f5e4aeccd19ca1
-
SSDEEP
12288:dmWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgp:dmUNJyJqb1FcMap2ATT5itjCYZ3DSo
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7487b4b9a07a4b63acbfd0015b07ce31e4beb71bc32ea1b897e3340b7de47247.exe"C:\Users\Admin\AppData\Local\Temp\7487b4b9a07a4b63acbfd0015b07ce31e4beb71bc32ea1b897e3340b7de47247.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD593d92b33a913f1d89cd67fce6bc62110
SHA1eae5d56ee0e0d754eff1fae43162f6f89ee77d30
SHA2566a59ac732849d8fa5b0668109e1580c3086795506c80ba77c6b5e73fc6fe1552
SHA5127189449f15bdbd5908aad6ee7177080f448499ea73d6bb0cf92ad7c927fadd744356202d13d86275c3a59e7ffa96d7cd7a47da080d6456befc5e1296471ac277
-
Filesize
481B
MD5037fbc5c8fdc820cec4cb5297f8e935c
SHA1e7e14e8bfa63dacef428bbc89b3300246eef73ed
SHA256e7bd921009ade95f89de2fc10e5467e584a6e42d001f22b61eacbbea15cb8e30
SHA5121e7df0b6cd5cd9052e37c6b16f331faf3b4cdb07dbf72716e642d0d3a72e24e71f8b5f04f351505be651f42efeec8f23bdef0c5df14a9606e072f8517207388e
-
Filesize
686KB
MD5812d5f569476848e3495e0606c13026a
SHA19402db64e8e36c17c14ac0c55cdcd957de05144e
SHA256d01983646aea612c0cd39155f6d1a6ce803446ab1f269f988d085be9f2ea94a4
SHA512e6dd73d7dbfd0bf9d290040772988c5c664c1bd03db0d3073ae634bfad3ca156c2efccb3538fb288a0462de7bb7a267a4da3c6cd527897fd77a2b51e682c6ca1
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
732KB