Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-12-2024 17:52
General
-
Target
8163790da9d88d1ed171c2329f1d708f510943e56e7772b7571db7242e72d486N.exe
-
Size
206KB
-
MD5
6bd1ad2ff10fea4b9393f42f8b9632e0
-
SHA1
4962eac58fac1b51d28973bf57c8cce4ff49c765
-
SHA256
8163790da9d88d1ed171c2329f1d708f510943e56e7772b7571db7242e72d486
-
SHA512
bca3b834cfbf5f0901fa6a25781b5dd7a5c17505162d647ccd43fa853dadf048254ddc89629f126243bd87d82c03e6a4acf23aa1fb9f9efe0ed06abc05c5c009
-
SSDEEP
6144:k+EqFQ9A9ty5bhJcrs0MurPw/c4hd/B/coyXT3nOGX6T+:k+U9qyFhJy56d/eoyXjn9W+
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 9 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8163790da9d88d1ed171c2329f1d708f510943e56e7772b7571db7242e72d486N.exe"C:\Users\Admin\AppData\Local\Temp\8163790da9d88d1ed171c2329f1d708f510943e56e7772b7571db7242e72d486N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD501f9b8a080bbb4a1893b8a462228d181
SHA1fe2e9c6119c362088a978460958480e55b129afc
SHA2564b15595fa74776cca7524b0e21d5e607e8203ec170229f7ec3669c89b16aeda5
SHA512c90fbe50ab32865d691160ca093c5b3935135bf6418ef3532a27d62213ee5c5c134483177bf79983ae32d36f27e44c2086faaf7475484c1ac6a81cc5e64d7f14
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
596KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
596KB
-
Filesize
732KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
596KB
-
Filesize
328KB
-
Filesize
596KB