Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2024 05:47

General

  • Target

    a0ead56d1eb968d14d374c0436571c5ee6f6a927aabadee2102ef85e12532e23.exe

  • Size

    266KB

  • MD5

    6e0f8f94bae095c2d0776d312cf535f0

  • SHA1

    b45bf27f03885a50e5de1e3d1d6c60ac2305eac1

  • SHA256

    a0ead56d1eb968d14d374c0436571c5ee6f6a927aabadee2102ef85e12532e23

  • SHA512

    634535cdfb617356c05851e31e51c7940627de8dbdc516724d357406d6c960575b638372c908219ed676a539d4eb0ccf6493e19d00133ae138feb60fc5c3ba80

  • SSDEEP

    6144:NAA5h+K8ze8SUPUvE0/X8b+rEiFsu6/kDmKJ8GC3A3c9:S2QKP2r1itBDmEyy8

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0ead56d1eb968d14d374c0436571c5ee6f6a927aabadee2102ef85e12532e23.exe
    "C:\Users\Admin\AppData\Local\Temp\a0ead56d1eb968d14d374c0436571c5ee6f6a927aabadee2102ef85e12532e23.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2080-0-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/2080-1-0x0000000000220000-0x000000000027A000-memory.dmp

    Filesize

    360KB

  • memory/2080-2-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2080-3-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2080-12-0x0000000002580000-0x0000000002632000-memory.dmp

    Filesize

    712KB

  • memory/2080-10-0x0000000002580000-0x0000000002632000-memory.dmp

    Filesize

    712KB

  • memory/2080-8-0x0000000002580000-0x0000000002632000-memory.dmp

    Filesize

    712KB

  • memory/2080-6-0x0000000002580000-0x0000000002632000-memory.dmp

    Filesize

    712KB

  • memory/2080-4-0x0000000002580000-0x0000000002632000-memory.dmp

    Filesize

    712KB

  • memory/2080-14-0x0000000002580000-0x0000000002632000-memory.dmp

    Filesize

    712KB

  • memory/2080-15-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/2080-16-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-20-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-18-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-42-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-44-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-43-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-53-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-45-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-67-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-46-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-47-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-83-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-48-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-86-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-85-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-84-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-82-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-81-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-80-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-79-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-78-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-77-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-76-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-75-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-74-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-73-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-72-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-71-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-70-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-69-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-68-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-66-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-65-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-64-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-63-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-62-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-61-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-60-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-59-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-58-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-57-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-56-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-55-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-54-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-52-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-51-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-50-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-49-0x00000000028B0000-0x0000000002968000-memory.dmp

    Filesize

    736KB

  • memory/2080-106-0x0000000000220000-0x000000000027A000-memory.dmp

    Filesize

    360KB

  • memory/2080-107-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB