Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
28-12-2024 00:48
General
-
Target
9ce1e68275dc2893594d58c2a750a4e13c78ef1033ad995526a65c10eab04235.exe
-
Size
208KB
-
MD5
bbbd16d4f7466ccab85cd2203a77afe5
-
SHA1
863c78ca64d9be2b6f5eabf8228e174dfef72e2a
-
SHA256
9ce1e68275dc2893594d58c2a750a4e13c78ef1033ad995526a65c10eab04235
-
SHA512
def0c2fdc9d4305c41dd5060d5203f9b645a229115ccdde0f5d4d7db8c249697eae0d067647e4926b2d8280877160c12fa10854377d3fb9957a7da3fd83697a8
-
SSDEEP
6144:vZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5:BquCuygMQjd5vJIBP1
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 12 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ce1e68275dc2893594d58c2a750a4e13c78ef1033ad995526a65c10eab04235.exe"C:\Users\Admin\AppData\Local\Temp\9ce1e68275dc2893594d58c2a750a4e13c78ef1033ad995526a65c10eab04235.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD5a8d98cb11a10b2e38a62fd0374466634
SHA14271d8b2ca568d945633a038dd0ce5cf7fa2be7a
SHA25698c387f18d9984b9de801db8048f164b7ad5e7a439696308bfabaa781b2c5f04
SHA5127e64832b15d93440f768f8ed89866820ead63657c63fbb168a72b0a2c3011f34b40f0e67dd3f664dabbc181e28febb9c445e3822e7bc734dd36c224c1c6fe650
-
Filesize
564KB
-
Filesize
328KB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
380KB
-
Filesize
564KB
-
Filesize
564KB
-
Filesize
564KB
-
Filesize
564KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
564KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB