Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05/02/2025, 10:26
General
-
Target
83b9c68eef5d448a31a604b2f82e7f066991c30a75c24ae96364aa985299bb48N.exe
-
Size
218KB
-
MD5
96e0f884f678e5d1eb9a4c3510eba970
-
SHA1
6c810af7e17f0dc66dccb3836ad745b952ff77fa
-
SHA256
83b9c68eef5d448a31a604b2f82e7f066991c30a75c24ae96364aa985299bb48
-
SHA512
6d825c859acbd295964e8caea9a9170ad506bfd2a2a98fe55765b1278475bbc27a5d129db73323f3736ad80f9d06654ec722171cbd451d7bf8a7ef85198dee11
-
SSDEEP
6144:OEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICW:OEGDdQNHEwWlMxYG/wIR
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\83b9c68eef5d448a31a604b2f82e7f066991c30a75c24ae96364aa985299bb48N.exe"C:\Users\Admin\AppData\Local\Temp\83b9c68eef5d448a31a604b2f82e7f066991c30a75c24ae96364aa985299bb48N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5aa6bb2771f7be3ef4775bb2cf2e640f5
SHA18940d96bbfadc7a268157431217174f423b90c26
SHA256046f2162f61d0f6f3678fc5869e23a76ce0c7a21b09bc1e61b715c489d6eaa76
SHA512d523012368eeb2b95735402f0b243a1345c39462e0332038b1453c14fcd6bc9c56910187e269153e653daec8ff76b8ecf0fc71aaa55df2e63c95b747e6d795fd
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
218KB
MD52c9bfe0b69f209e73340e9b14baffc39
SHA15a2dd97885f52cede3160e2f4f96c7c9b49d7055
SHA256c9403431f21cd4d2f75595ec65199907dcb4a2e4056a43a52aa6ee6210f72167
SHA5120a4e83b47210698eb77390c7c916497cdf375c85e7fa626541d04937f7325e279ea6a4189195f54f14c5fb98172b1f411b761208b716c73d0757a87c1241c97c
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
2.8MB