Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
20/02/2025, 09:57
General
-
Target
f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1.exe
-
Size
217KB
-
MD5
1af2c59cc3845e37288c679574c541a8
-
SHA1
a06bc23d1062217467df4a054db91c55039dbd80
-
SHA256
f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1
-
SHA512
350e75f5936d69e8e00368e37aba153c7dbadc89158b33e18b0cc3b9f431804f84e8b295744a949e1d4aa8cd49f6e551c0ec40027972018f84a04a4eca70b898
-
SSDEEP
6144:irRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:IsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1.exe"C:\Users\Admin\AppData\Local\Temp\f9a04a239351caf8909c9c2ba16b568238a70db8273502983105bba3c9a28ce1.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5859f328c2970eee8c75a6299181ed07e
SHA1e34b33f9b4c1477d59020be1a4496012e54b1dde
SHA256e233f6fb62075c87cb922a565593d867cf4dd8026e515fc8ba92209a0de28d72
SHA5123b726bd85773323590a2ca91abe5cb0ecf24991dcc0a5d56ee2821bee20153a3ee41651397f8b939752d2c921eaf53ce321c837bbf7453c65e816879e7794a29
-
Filesize
42KB
MD50df31c48a87a30917c685b695b68c5f1
SHA1913934f05a3ceb84536161d975b6fafeebeb38f1
SHA256633fb00dbd266ff0f2fac2b244b2a71380371e9b9f099821cb258d84ab915dfa
SHA512701e7b50a5ac0926c7c702abf34ffc823684e1d0299aefd06c1af8356d007b7cf64a2255d821101dda07860eae690d83410074141beda2be24dc869bbf836320
-
Filesize
2KB
MD517b89bd95116d6801995a328996f0273
SHA1d1f634528b072a82b23db8bdb4191de5b5b1ce5d
SHA256ab24de67e99a412132bb5b0f008bc0b3371e01899b18ddc73019ec3ecbc91391
SHA512c547a06c64316b0cb9572c15a74a5bb2c1b526b6171602209ccc75a44803fe09f27e126df5319bde0f29b519ebe914e5caa19671ee7d877b4eaa71716db0eaae
-
Filesize
481B
MD50dca226354c4212a39c55c16cc1e764e
SHA145b364a003db844a14ad5dfe4ec2ce3e4453bfee
SHA256cf3bfd1d147d1ad019fef2f27f65f4583271e035de460dd829e8e9e528d30042
SHA512d100b932c576e35df5c8717dbf11a413e6593e4ab58b122267c9a7c0b651c2789c8329bdfd8c4cb8fd14222d762e0a3ae2349ae625348e946e2bdf7434c01f0e
-
Filesize
217KB
MD588a43d05c8f814d3c83745857e69c3a6
SHA1101f37ed3ce3ad465570e9aa2b5618dd2df8e4d0
SHA2567d03be2ee85bf3c8137a2bad4a15f5d543833d204d57c0ea24c04d8e78504a09
SHA51243e224effe0050cdf841131309dcb9ed4e7413ee781b49dfc222f6a65c4f36d17d8c4fceeb6cf7f874661de48b1a2a91cbf6ff63e0ab9034ea3cf19a5d45246c
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB