Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12-01-2025 16:28
General
-
Target
a3122701dab9b1b39995f5ee4650f8b8d4d363fd8dac84f3d777ca255fdc1015.exe
-
Size
212KB
-
MD5
a2c2173c7b0957707948947f74193691
-
SHA1
573be8b7ede22285db8c9c763228e7ab26d6e9cd
-
SHA256
a3122701dab9b1b39995f5ee4650f8b8d4d363fd8dac84f3d777ca255fdc1015
-
SHA512
c3fd2a4e5175b2a0af3757909b379ab025951b11c0d4923ec795950939f5895b0f46244976fb8515f20191b4d44e65995b1731c87a9301f6ac9860170ecf0649
-
SSDEEP
6144:yob34ERMS/H7YAVsobrVn5G4E3Hi96mbQzJWFO8Omw4Gp:lboEj/8ASWM4Ki96/zqIKGp
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3122701dab9b1b39995f5ee4650f8b8d4d363fd8dac84f3d777ca255fdc1015.exe"C:\Users\Admin\AppData\Local\Temp\a3122701dab9b1b39995f5ee4650f8b8d4d363fd8dac84f3d777ca255fdc1015.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD5a973ccef5d80d7bacd27fffa6893f85f
SHA113c286cd27ffcb27c76b79d0afb90438054b67fa
SHA2563d380a3c16a9c0bc7196497391dc3598e9ebaea8fe58d4701537e2fc8a15f868
SHA51202444262076dddeef6d7078751c41ed06b24c4535370fd29122cd8270142463020e825919aec4fc5e51677a02e0e8fa0b2f2b6645a7d2d14b1e3cf49e4fe1deb
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB