Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08-01-2025 06:28
General
-
Target
ad857f6c3ddcec462a918e4cbda2982493d17d774b6a439b4f7e45854076c600.exe
-
Size
208KB
-
MD5
f9f19f161feb6743dd7059b71c53982b
-
SHA1
559d105c04102403aba5112ba3c05e9b653f75c4
-
SHA256
ad857f6c3ddcec462a918e4cbda2982493d17d774b6a439b4f7e45854076c600
-
SHA512
6d0dc5e85654ecf2fcbab25c234c2e95ae4a35c498270bb47de9f0291ebcefa55693a7bde64b7abd84d0d5e057a018904c117405bb230b1534211e9ab4d612fb
-
SSDEEP
6144:QZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq56:equCuygMQjd5vJIBP1p
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad857f6c3ddcec462a918e4cbda2982493d17d774b6a439b4f7e45854076c600.exe"C:\Users\Admin\AppData\Local\Temp\ad857f6c3ddcec462a918e4cbda2982493d17d774b6a439b4f7e45854076c600.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD5facbf8a9ae2bcda25dab6648bf0bb695
SHA186af52cf42cbd4c668413dfdf71c5a93698e6386
SHA2563b1d54fe1617306f80734a96ce0008d25e6b38b025b1b7c4b0f1ccc45d5b1a33
SHA51211ae6966f4c3189df2c39e19b5e508219119bd445e2c39fa48b341847326fe07b4f20a61582c7e34a343afebf96958477ceb253dae7032406ed76784a5e6ff56
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
564KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
564KB
-
Filesize
732KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
564KB
-
Filesize
564KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
564KB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
564KB
-
Filesize
380KB
-
Filesize
328KB