Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
05/11/2024, 09:09
General
-
Target
9f192763f3fad8f3f9944bd7d29824f5c6319dc1adf15036019fd33783bb898eN.exe
-
Size
209KB
-
MD5
bb18d7f28135589c7f56e54e76dc3130
-
SHA1
0ae95b21242486b866fd986d7c5608330ba8e2c0
-
SHA256
9f192763f3fad8f3f9944bd7d29824f5c6319dc1adf15036019fd33783bb898e
-
SHA512
fb964de784866fa6042aade0a25514bcc184b2103a17eb5a86904d76c165e34f986e1cc8060486fce8fd4c400d0fdc3d4f4dfaeab8d4e4ad9f9a6d621fc2f4f1
-
SSDEEP
3072:GEdOQzZnx6OJPa0UVKS1DNB4jQVckmFP5GTBiRw0OZ9pB05OZalrl7Sy+uwY4d:PzZnx68OKSOjQ7m+TUWzpm5aSxTXw
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 10 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f192763f3fad8f3f9944bd7d29824f5c6319dc1adf15036019fd33783bb898eN.exe"C:\Users\Admin\AppData\Local\Temp\9f192763f3fad8f3f9944bd7d29824f5c6319dc1adf15036019fd33783bb898eN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD525d8b94ff586820f54312e7dc9290cfc
SHA199db7e5fe45efe50d590e7c8e437c1b0653d17e7
SHA2560ba46860e72835f18b1ee41f721dede256719c36bf7806d21a619154fe68b9dd
SHA512d11479bf47ba6ffb9903ce2a0a499b3e4300ce2024d61e7add7c9e65e448d1809ff51dc40209271678a05bc4ee3796c4865542bb95747a65165f723b9876df88
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
680KB
-
Filesize
380KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB