Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11/11/2024, 00:41
General
-
Target
87651eca3d0805dfb6101740fef55a8624c8f0d1103df0d32be808a29659e241.exe
-
Size
215KB
-
MD5
64da2a3954188fbe50b5b900f61e8444
-
SHA1
58635d75f3f12a7c0135e16694c948e08f0dd4fc
-
SHA256
87651eca3d0805dfb6101740fef55a8624c8f0d1103df0d32be808a29659e241
-
SHA512
71e8e9f5966875af8b1af526ca348454bd14756d48e3943b2dd8cdd1c957225c2bc8c652023cd4037c3999f14ff922a978b20b8df3ae638a470f6983bf777fa0
-
SSDEEP
6144:PJcxlKhSGoqTecGy9+hAu7//QnSrMhcZEps:PS8hbTiyqA4QnSQhcZ8s
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 16 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\87651eca3d0805dfb6101740fef55a8624c8f0d1103df0d32be808a29659e241.exe"C:\Users\Admin\AppData\Local\Temp\87651eca3d0805dfb6101740fef55a8624c8f0d1103df0d32be808a29659e241.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
215KB
MD50d96b39952247d9ac415e79c06fc6af7
SHA1e99a5bc744ce818cfb4f0ed0bab6e45f35434d22
SHA256394edb58bc425af08ea150fdd80e887233904d3984170247e6f69a16b16d31ab
SHA51261a9dc8fff89a33f421bfc49ac0a6c23c49618ff9a80dfee1d020646722f68734b186df4346f76284608766c9d67a28292aff9b25274f7e5c8ee50f3becbe5aa
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
680KB
-
Filesize
392KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
392KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
392KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
392KB