Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
16/11/2024, 20:34
General
-
Target
021600fa80cbe5a596e8da91b27f3e209affdb16b0af89ea45e3b17f2c4bdf6c.exe
-
Size
206KB
-
MD5
7fadfc6e6839604347c2d43b6641bb3a
-
SHA1
e4c7a35fd0245b2eab6b1f634967d9288c19fc28
-
SHA256
021600fa80cbe5a596e8da91b27f3e209affdb16b0af89ea45e3b17f2c4bdf6c
-
SHA512
cfc679b8807711541733482f9d070bea10c2cfc8129216d58aa620f12ce4a9fe371ca5689091359f11777ec025317e0f9d2f8863121377e8e8ed60efd6cd6fa6
-
SSDEEP
6144:W+EqFQ9A9ty5bhJcrs0MurPw/c4hd/B/coyXT3nOGX6T+:W+U9qyFhJy56d/eoyXjn9W+
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\021600fa80cbe5a596e8da91b27f3e209affdb16b0af89ea45e3b17f2c4bdf6c.exe"C:\Users\Admin\AppData\Local\Temp\021600fa80cbe5a596e8da91b27f3e209affdb16b0af89ea45e3b17f2c4bdf6c.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5ad3f314abea85a82e035454ef78c52c8
SHA12ba47d3572fd6f0149ee0a268ea68544f250b39a
SHA256f40aa6e4b0cc75bc98e9c228aa6951ed61dc7458a76e0eb88d5167c31b39f0ec
SHA5128e546ce04dff46c9ed49ca7e7536a268dd2f8a819bd31d3b381c86c0721c6609f89fe58c27b6e43ba2d9f6de5c340c4fe7173ad8be230ea2f5a5716dee505d7c
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
596KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
596KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
596KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
596KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
596KB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
596KB