Analysis
-
max time kernel
112s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 10:07
General
-
Target
86ab1543464500ccdbda0c7c5f30d40628f0892a19a07e5eaa21ddb2774c7ab7.exe
-
Size
208KB
-
MD5
3add94fe3f9cbeddf525f2d212c0d093
-
SHA1
53d1182d535f720d41d7cffe0316f3fb56e026ad
-
SHA256
86ab1543464500ccdbda0c7c5f30d40628f0892a19a07e5eaa21ddb2774c7ab7
-
SHA512
d66fcee4cd245f856547ab1dc6e62a117f387df608b2e7440081b690472be28de55137b5c0b920db2d819780ed6d7fd18c862c4f5c7211a2ba8acff2ac642fc1
-
SSDEEP
3072:ZUpRi1s+S52fNiQGUaqcJeGwxruUIiau038t6eTNzW+XERycnR3FPEtprO8OFb56:F1wuNiQj4hwBEu0MYqVmXBFPEjRiGdh
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 9 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\86ab1543464500ccdbda0c7c5f30d40628f0892a19a07e5eaa21ddb2774c7ab7.exe"C:\Users\Admin\AppData\Local\Temp\86ab1543464500ccdbda0c7c5f30d40628f0892a19a07e5eaa21ddb2774c7ab7.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD57cfdc9476a43dc8c42e3c02f29b56db5
SHA1a635557040a0d0ddd654c0173962097ab489ac75
SHA256c077980752196e1d5123bfe18c5a4e03800e5d781bb7d1608fc34fd7f4b2a938
SHA512ab4dd2c642f32c791990880bb2bed78297970426bcf622d0126ba5fde2886647d99421adc50a2b49331f98917df53295619a74a60e21e9567f804ab156004cee
-
Filesize
1.3MB
-
Filesize
328KB
-
Filesize
380KB
-
Filesize
1.3MB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
1.3MB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB