Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
27-11-2024 19:54
General
-
Target
5a0c28d4c01d7ea5d9cf571e1fa68183e9be620c11a5da189f9b6f203704b93c.exe
-
Size
304KB
-
MD5
277dd8304ec993dc080c2e6028663928
-
SHA1
eae6671a89672260d8543cf44246dd426dd3f057
-
SHA256
5a0c28d4c01d7ea5d9cf571e1fa68183e9be620c11a5da189f9b6f203704b93c
-
SHA512
9151c66d9901135507810cf3d76ce7d4f108fb32453285e638fe828b04eff516f591f7fe5c222ee886cb4c0bb0b22b52b3360709f749b374e6bcd9b1abb93768
-
SSDEEP
6144:AYK/7lTZitfjaRhSm7qfDjEGYyiVhK7c3wJplHM0D/2zhZ:tK/7uaXh+bjEp/AVRDeFZ
Malware Config
Extracted
simda
-
dga
cihunemyror.eu
digivehusyd.eu
vofozymufok.eu
fodakyhijyv.eu
nopegymozow.eu
gatedyhavyd.eu
marytymenok.eu
jewuqyjywyv.eu
qeqinuqypoq.eu
kemocujufys.eu
rynazuqihoj.eu
lyvejujolec.eu
tucyguqaciq.eu
xuxusujenes.eu
puzutuqeqij.eu
ciliqikytec.eu
dikoniwudim.eu
vojacikigep.eu
fogeliwokih.eu
nofyjikoxex.eu
gadufiwabim.eu
masisokemep.eu
jepororyrih.eu
qetoqolusex.eu
keraborigin.eu
ryqecolijet.eu
lymylorozig.eu
tunujolavez.eu
xubifaremin.eu
puvopalywet.eu
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a0c28d4c01d7ea5d9cf571e1fa68183e9be620c11a5da189f9b6f203704b93c.exe"C:\Users\Admin\AppData\Local\Temp\5a0c28d4c01d7ea5d9cf571e1fa68183e9be620c11a5da189f9b6f203704b93c.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
420KB
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
560KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
420KB
-
Filesize
228KB