Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20/02/2025, 10:00
General
-
Target
f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1.exe
-
Size
217KB
-
MD5
1af2c59cc3845e37288c679574c541a8
-
SHA1
a06bc23d1062217467df4a054db91c55039dbd80
-
SHA256
f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1
-
SHA512
350e75f5936d69e8e00368e37aba153c7dbadc89158b33e18b0cc3b9f431804f84e8b295744a949e1d4aa8cd49f6e551c0ec40027972018f84a04a4eca70b898
-
SSDEEP
6144:irRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:IsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1.exe"C:\Users\Admin\AppData\Local\Temp\f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
41KB
MD540286e2c253104246021fac609bd0a76
SHA169c31dfbf42dc9696d6b08711afe6a08d771e824
SHA256d7262ad6444975f69ed4e3371af591292585414800abdfa8fdb15e568a866309
SHA512ede7a23dad79ad496ce23b5f3041c4522422698b4af535fa839d9e0f98bb6d8be1cdcfefe280490ab4bfdcd24054b5edfb5394d3101c7828ccd0dcd47b3d58fb
-
Filesize
2KB
MD5e996dc071ca787db6c45e2a610f782d3
SHA10cfb50250eda6399b71aa6e03f9efb3511a8b0d3
SHA2569c24a4f242599a00b0050980952f466a69d6e2bc3896aa8f070c2081a274a664
SHA51202a9c10f39823a4b521fb4806d7ce9bb5e47c462bf4379abdd9d295194962cafc947b13b2546711965fc078beb9c15afc6ddfbbc517c2f6ac37a5a235d84604a
-
Filesize
481B
MD50b615bc6b46562c723e4ca8c7f748d08
SHA1cc35946248f5ec1f35aa29cf63b5b578809f1a38
SHA2567eb160e550e89736fd325e6ff242bacfcb34675a178f893bb76c9d5f4b907566
SHA5121f80de5c31689f4d349e5578d7d6f20503068e508f09d8f734369439cc156b5887b1069168251dec402a51b2f18e5042d04a8e7f5e4f823cd629466bee1830cb
-
Filesize
217KB
MD53c36a793947bf5babf069a401df5b409
SHA16ea0f6f86ce6029a623c7528ff44355d72d5366d
SHA2561c11bdae700b76d85090b3642132069192cf5f11f7d0e8c36041798105b5729f
SHA5128159c8374a5111618f8c5e49210b0750ed3e4508347bae86ee31824d72c6cee5143796d0b16048bb1a6c340b67df19771a0c08ec67c134836730508e7f7e2e51
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB