Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-01-2025 12:31
General
-
Target
f2ac02de600ae28be320bf83d96d648c3a2bac0433dea98f37d46fa4b538afcaN.exe
-
Size
208KB
-
MD5
8cdcb923c4283ab8c5484ec581fd88b0
-
SHA1
264d62c3adce571af8eb288ea89a5d8767d1eda6
-
SHA256
f2ac02de600ae28be320bf83d96d648c3a2bac0433dea98f37d46fa4b538afca
-
SHA512
53c0894e31c4dbb7cbd4b10eb2028bba372871f8bc8029b274c5761dffb61bb42e67bc98a68f999aefe7b1049373a6038c0984b2a4f7cd2f1fabc4edf6584d25
-
SSDEEP
6144:aa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:abapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2ac02de600ae28be320bf83d96d648c3a2bac0433dea98f37d46fa4b538afcaN.exe"C:\Users\Admin\AppData\Local\Temp\f2ac02de600ae28be320bf83d96d648c3a2bac0433dea98f37d46fa4b538afcaN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD58aa38d30fd4c0b7826533bb2b0967b84
SHA1db29020847385de6f8310ce7ad9a4df8bfc0ebe5
SHA256b5383dc31149fb69ae6032cc965876720e8dfa8ba87b8efe9345ba469af0a22e
SHA51229cc945bbbc6115c72c38538787ed278dc7f04bae3fa82850a86e540eb331d5de8cc25b888b61281479f2bf104e463eca567bad5a27cc640dd80b6cdf34acfcc
-
Filesize
208KB
MD5a28835b584c3de1ba598a780c5c8d34d
SHA194aaa369adee873a2685688e171a3c48be3b477e
SHA2566eebfa36a5f2f3fca83bf98f47700d09fd7d0e3861f8827b06d39660c8733fd1
SHA5124e697d9239131789c48e6e5f6497528b39d5e46741d4ef4f603f2f11020b8cea5f96a785368a42c3500dd3054760ce4cfab2fa492cc89e06ca83a5aea21e36e9
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
12KB