Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-01-2025 02:43
General
-
Target
8d2aefebf0ce40c4915da4591c80f2efaceb064f052505e73123473abea165e3N.exe
-
Size
213KB
-
MD5
f9437ba54352b4d591cd9ad6cf764b60
-
SHA1
09451243d0ed586d6f521df953cde02cc52e5d95
-
SHA256
8d2aefebf0ce40c4915da4591c80f2efaceb064f052505e73123473abea165e3
-
SHA512
e711f9df01c10f8efede005dcc79f5fe271e94dafc90b193cb4e24bc29ffafdc3864927a81e54725cb050839684c6fed1647abc18bf317d3f610b2ed7b592228
-
SSDEEP
6144:cQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy:LXkej+f4VDOEVdbgt
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d2aefebf0ce40c4915da4591c80f2efaceb064f052505e73123473abea165e3N.exe"C:\Users\Admin\AppData\Local\Temp\8d2aefebf0ce40c4915da4591c80f2efaceb064f052505e73123473abea165e3N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213KB
MD59f01f80c3c769327c325e96373c8b705
SHA17ebd4333999c98f7b0afc1189652f265279bad8a
SHA256120aa44d9da798ffd5fea0ca4611a82d0681ebf5d889fd12362476e8f4dc9e6d
SHA512274d6186b51ec73d3bb1638763ba15c5210035976b6d93b2a6651cd52cf708824e8b33107b1fb925b30afe00ede50569f093061d6a6c236acf73ec79cee82704
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.3MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
324KB