Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12/11/2024, 13:14
General
-
Target
dbd6305b0c0faf3208f3282e7afa40c371e0f08149c7b7c6a7995c0ff93639ae.exe
-
Size
212KB
-
MD5
3dfa1075101f7ed661d72799b0779f27
-
SHA1
8fe65f45782eee6a0165bd257450f9f152075e88
-
SHA256
dbd6305b0c0faf3208f3282e7afa40c371e0f08149c7b7c6a7995c0ff93639ae
-
SHA512
28b7d81819ef15d550592ad60eedbaca87cb2e214a59cc8a164a5acd734c1ab50335709f7b163eb3012a62e1bf4405bc05d0aaa72474c81bc5517d94a021d92b
-
SSDEEP
6144:RxNqLW6opBZMU/y/JEGjg+op2BSNCCr7/jU:XA6NBT/yEGjWwa7vU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbd6305b0c0faf3208f3282e7afa40c371e0f08149c7b7c6a7995c0ff93639ae.exe"C:\Users\Admin\AppData\Local\Temp\dbd6305b0c0faf3208f3282e7afa40c371e0f08149c7b7c6a7995c0ff93639ae.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD577990ec241780ab1d0cbc474ae5b3c37
SHA18c01fbfa395b271f0fd773714eb3a17c3849ae39
SHA25668cf018c34ab2a300a798653a01f3cede46c3867aa04e8ef2a82608d95860b2e
SHA5127f8f3e42804d0c55adcd9b25c4856bcc2448f7e7a6e5d39d483e1ac9035cf2fc4237f44bf3bcde5b9a1cbc4f3a67d5bc3a66ed5fb8226908842afadbaf7546bc
-
Filesize
328KB
-
Filesize
380KB
-
Filesize
616KB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
616KB
-
Filesize
616KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
616KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB