Analysis
-
max time kernel
110s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
03/01/2025, 13:00
General
-
Target
9141dd8484bac472ffe8f9d26a960aa6efb9028b283b24fa5609501997b9d225N.exe
-
Size
218KB
-
MD5
3d7e637fda7757e4307ae6d8af640e20
-
SHA1
9d37019574b6ea3e60bdf600869c113a104b362d
-
SHA256
9141dd8484bac472ffe8f9d26a960aa6efb9028b283b24fa5609501997b9d225
-
SHA512
38ed12e5c54a75044f24760b48b8c8529d20f80d73827fb064bb0a9ae1605ed6d4408edf6eea1477265596f126482fb7166fbaec9fbec6b2ea0245119471d24a
-
SSDEEP
6144:UEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:UEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9141dd8484bac472ffe8f9d26a960aa6efb9028b283b24fa5609501997b9d225N.exe"C:\Users\Admin\AppData\Local\Temp\9141dd8484bac472ffe8f9d26a960aa6efb9028b283b24fa5609501997b9d225N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD566d38c047025717d54109677ace8c2ae
SHA16ed2a019dc018db79c43e600059dba977d67545c
SHA2567a4ccc5dd46063aaba262d6080a7c04ca29f4167dbc4e5a465f6c542a83cf6cd
SHA51220b8071ef4fbde375a29d357e2859d3ffcc583b5909ea08e1ce9c1049c283e1fa6850efe50d3bae2e4c801ca722793129a4f0596d0afd8f8e9ace04b3d4e2bdd
-
Filesize
42KB
MD521a8eef614a7bd6cc89c6498f3b417d1
SHA16a08e12cebf2d7c11126d144e36283f76102c805
SHA2566fcf1eb0ad6560c38afdbf31ed0ae65ddfcf7bdbc1430efef444b1719a00e89a
SHA512ccf476e60c57696a5ad5e45b31ce95a39283735faf54e7204ba45559656434ccba2cf0953f2b01e0f304fcfcfab6cd5ca95f5c22efeb0bb21b6aa0152d387eaa
-
Filesize
218KB
MD5817190fbe0790de24af6f02a24beabd2
SHA1ee5f63de86e3a061ff7d8444ba98ca9bdc60113b
SHA2561d94963a6ca66a3db0319a72633f8d8c4401cdc0715b688f7205e19ee263f76b
SHA512ea9efa89c75ba8c61a6ee70f23dcb2ce9d1adfadab0381d780053c54724c51a0ade47ff13636cdc95b6ce1929be925e8d81314f1d4de7856a29a3f8c458b08f7
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
2.8MB