Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08-01-2025 21:59
General
-
Target
2f5f7fa17cadb76fd5d27e07e5369b0cda3e275c92a20be681cac102ccb524b4.exe
-
Size
218KB
-
MD5
e14685299f395ed7d429180d41e81e13
-
SHA1
3692c9bb4094be1a8c4104219022d88042bacd0a
-
SHA256
2f5f7fa17cadb76fd5d27e07e5369b0cda3e275c92a20be681cac102ccb524b4
-
SHA512
c2b7f1a96a1932bed3a108109aaf76f921923ec7737106dd8f40c8c92ef8229da41ea8d771490784dd0a0335056a2caf610f9b57c5786c3ff35b91c6d01ec420
-
SSDEEP
3072:Wvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:I1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f5f7fa17cadb76fd5d27e07e5369b0cda3e275c92a20be681cac102ccb524b4.exe"C:\Users\Admin\AppData\Local\Temp\2f5f7fa17cadb76fd5d27e07e5369b0cda3e275c92a20be681cac102ccb524b4.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50bcba42bd5bd71679c2879f23a80b4d3
SHA11801d4b0672c5c9298e12eb5be3ec20e4899f5af
SHA256abf081f835a1aad6ce589fa9ed532b9324795583e7e577fc30b630f0e9540d25
SHA512184c544b4d580a3e135d032544a2c7d5c8a6912eb005b6fa97c30360c05e615945eabe609d2ccbcaf242941fbbb207e7b268e99b0a5ad6d8eaba24d6508cf26c
-
Filesize
2KB
MD56b2037f76c5f0b8bb7173ca4e1f08cf1
SHA19577b10fbc2c265a2191f03191e6321b8ad9487e
SHA256cab78ac9cf2bf628369462254329b5504914e53d0d5471adc33935a4340a2a87
SHA512d5ac1195070d9e05b9620b486b913fbc79311285c62bf243691e8c2321fbc9587c4b76ef3f06b3e6791b8727fa037144a5646ce34f93de8c35ee0539a03f125e
-
Filesize
218KB
MD57a6e7ae444bb2a21c8a35700d60be7f9
SHA103ad3e6e4c8a4b1cd735a934f111e7b3fea34e2d
SHA2564468be0e9aaaa64a53faf8d61ab55eabd2ee145b5c6677f66e33400ecf48326c
SHA5129c278c75b950e6d6a553b68ec729db1045080e227baacfdc1b10800695006865b0328afe30511b2a718821e2db427372b96030694a4e967a3d58557777d68730
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB