Analysis
-
max time kernel
116s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-01-2025 23:15
General
-
Target
2bf612e3397df5b829f110f5e3844a8ce0965ce343fe64366a4b8b4c052d3dbaN.exe
-
Size
375KB
-
MD5
5d44dcb378dae94fa58e746fe6df6300
-
SHA1
755d09a4e82b4359bdcf81d02af38942c2372fa6
-
SHA256
2bf612e3397df5b829f110f5e3844a8ce0965ce343fe64366a4b8b4c052d3dba
-
SHA512
cfaae834375fc1230067522ced33383878a8b35f31f57cadbac4554746a719925ca8ee03fda23c64fb3038f7e68ecf6ccadcf01498a32752426382c39ccad342
-
SSDEEP
6144:Y3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:jmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bf612e3397df5b829f110f5e3844a8ce0965ce343fe64366a4b8b4c052d3dbaN.exe"C:\Users\Admin\AppData\Local\Temp\2bf612e3397df5b829f110f5e3844a8ce0965ce343fe64366a4b8b4c052d3dbaN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD50f6420a31132b62c4f1bfe7084fb75e3
SHA13ace5bd5e467af46c4c35abda4b354712853c779
SHA256e721259644626ce67f0efece06edb5e91ebf2ddd6f682e4f5a5c58ba8f6e01eb
SHA512be6962273924ad02dab43287b6f0a5125558b04091104b6a9e42cdd14c228223c83f95191e0221277b2b6cc0176c54e8013ab3d1d50555e2a5a3ecf0331ef712
-
Filesize
375KB
MD5317c1a19bc5e57caa4328288271afc4c
SHA1831199297c48a89a10964f1f1c85b712a2bd6d2e
SHA2568ecf4f8622b69c42f522569e266f832b075d4b9f56ad5cb53da617756c8e30f4
SHA512315f8ae91ba3e3617d1b30ff25e51e82297a99685294733da574b46364dca39f91757476fce8a2e68e54eaf776f3a99ce9a51239c422b9b44e91b13700c80317
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB