Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08-01-2025 11:21
General
-
Target
3ca75b8c8281ea1abb41bb7cd858621a15b394290360eacf62d725df956be3d6.exe
-
Size
600KB
-
MD5
4c2327e22a41948aec4f84930ad7161d
-
SHA1
732520960b36ef9b8d9f9374e43e32913c575f7c
-
SHA256
3ca75b8c8281ea1abb41bb7cd858621a15b394290360eacf62d725df956be3d6
-
SHA512
11915584f922e9c310ae5f880714af4c46b103cd6bd50dc4ebaee5821c28449319f337dd3f8c5a3a17ba72ff34992159ad5eb4db2e74aa9530d3711d03f541d1
-
SSDEEP
12288:CwmWTR1arYnEKosuzY34CZ3DQvSkNL9qyFhJy56d/eoyXjn9Wy:CwmyRcrYnxUzY3NZ3DQvZNL9X7Zyz9Wy
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ca75b8c8281ea1abb41bb7cd858621a15b394290360eacf62d725df956be3d6.exe"C:\Users\Admin\AppData\Local\Temp\3ca75b8c8281ea1abb41bb7cd858621a15b394290360eacf62d725df956be3d6.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
600KB
MD50d8b402789d54ce5ac90d12ed09a447b
SHA1caef285b074ce38a5fb67197f10d7a24e9a38362
SHA25636e0193079a3022f8bb664f171710f302f12a5091e9684315d2b5851bbb743ef
SHA512570df10123c1149af0aeecd83559a93c1a26c996a932c96f1141cf136b6fc847802d7b68dcc570ea877d01e0868774837c73a739fca02906ad99d94fe035d886
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
600KB
-
Filesize
732KB