Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-01-2025 10:39
General
-
Target
bcba2ed77abd8673b912ae059d70a4c408995503bc396d3cab0ad463d1b87ef7N.exe
-
Size
202KB
-
MD5
19275461ec9c5ed26bf7c51cde55c190
-
SHA1
3a8ff65f459a87f7e1e537c81cd48aea6d42add0
-
SHA256
bcba2ed77abd8673b912ae059d70a4c408995503bc396d3cab0ad463d1b87ef7
-
SHA512
8677dbf1c706e498816c8b668f4446893da45e0b634302c0a981c9d5329ad80228911b3d37c36796da6e194fe87e119aa8c89b163d11706234eb3157af5ebf94
-
SSDEEP
3072:h8nh2Hrp3Tlp+soN3BY2ZBHetwcyf1w5DYRZPQaQrhu8ihDNugrBVgc8gbmT2Pcs:Wnw9lEs3hhyaubQTkhbrBVL8gbmT2Pcs
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 49 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcba2ed77abd8673b912ae059d70a4c408995503bc396d3cab0ad463d1b87ef7N.exe"C:\Users\Admin\AppData\Local\Temp\bcba2ed77abd8673b912ae059d70a4c408995503bc396d3cab0ad463d1b87ef7N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD57ad995103962fb2ebb4fa72e7a2b64f9
SHA16c2dd7f10c6bdbcecd876df93ea466f12ca90d8c
SHA2562e135884b7e940a73046b08d6f61353a1e5004a1ce6c5e75366c21774299ee1f
SHA5123ab91416de348ae37c2bc039cddb726aea72874048e645595e1143473154d17a173ad4bec96870b7fdc43c40dbdb4a842a6669227c3c85fdc2f22390f1a26892
-
Filesize
202KB
MD5bfadaa9af155943c426ac90c947605a6
SHA18df8ff356553aeac82e02b0170154ea80cde7dc4
SHA25623344214746d7b7f7e4cc256962c42e60de29e7358ab0f0531c29a3e4c02783d
SHA5122e36a7a518f9dc83b86a694b39fc48b62e45961ca849c8ae37df54c67417d2cd251be8839dcae97e8d8a7ec57536ae7a4671ba9dda79c3315f0dc12fb9a5c6bf
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB