Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-01-2025 09:24
General
-
Target
ca6eca82768fa09c7ac9a4ac41a2580b61af00c7a085ee3211da403deb00a347N.exe
-
Size
711KB
-
MD5
f971f006fa51662300692b61abebb530
-
SHA1
16e03b8ed80ebd29b55482247ebaefb68ccc5eca
-
SHA256
ca6eca82768fa09c7ac9a4ac41a2580b61af00c7a085ee3211da403deb00a347
-
SHA512
440111cdbfe906a27cd6573231d15649c1dbd922e81af646fdaea8cad2bb930569e3e7cd8d183a62252bcb0b5f067846c7909afabe130601d48900800550c943
-
SSDEEP
12288:DmWhND9yJz+b1FcMLmp2ATTSsdsmWhND9yJz+b1FcMLmp2ATTSsdS:DmUNJyJqb1FcMap2ATT5qmUNJyJqb1FB
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca6eca82768fa09c7ac9a4ac41a2580b61af00c7a085ee3211da403deb00a347N.exe"C:\Users\Admin\AppData\Local\Temp\ca6eca82768fa09c7ac9a4ac41a2580b61af00c7a085ee3211da403deb00a347N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
711KB
MD55c718a92ee63724b5a170296991b747b
SHA14e0188beb0393082f621baa3dfbe26a8878d330b
SHA256abefe23a48b5c53048f92f71eb412e490e36199aa2c83dc71950d1175b836180
SHA512d1fe3efdf4a4d4051beb7d26292b01ceebefbd19bf7a11265b20d4a8c89a1e417999b9ab2de4bf48ea9fbde6717bee4da0eb715f754a7b2c772f93c7ba80fe2e
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB