Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-02-2025 02:27
General
-
Target
3712d10d4290634ed0331fd3e28b177c5dabf714725c83fc50b53665419d6e3c.exe
-
Size
213KB
-
MD5
b2cb4b29dca97f8cb9cb4bce4106776f
-
SHA1
9f7e666be10267d01120eb723cc2d386773944a0
-
SHA256
3712d10d4290634ed0331fd3e28b177c5dabf714725c83fc50b53665419d6e3c
-
SHA512
639c4b33250bd2741d816c2d4b609ad7db5e6bda86d200a68be1c37bf445fa942f56621933fbca0fb33206cb0bb26e856c61ca26c3fad139c056db9e83c3c36e
-
SSDEEP
6144:OQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDye:dXkej+f4VDOEVdbgtd
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3712d10d4290634ed0331fd3e28b177c5dabf714725c83fc50b53665419d6e3c.exe"C:\Users\Admin\AppData\Local\Temp\3712d10d4290634ed0331fd3e28b177c5dabf714725c83fc50b53665419d6e3c.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213KB
MD5ae16a77c9aabdbf4112433cf7b73cde9
SHA16fdc7056eb00048f1e7cb2d7675a69aaf2af503a
SHA2560ede318f98599794b8c84719270fca14f641c750cefed15bd7a28202506ef6d6
SHA512dd6b2a3af5d19699d11f5f689ad6866522fdc15f2c9a240f74edef9a0d775ec1480e4c872c29232f04fe6eeed5726986aae412ab4bc6cee06921d7b3674970ba
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
672KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.3MB
-
Filesize
324KB
-
Filesize
2.3MB