Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
30-12-2024 21:01
General
-
Target
aaed7210bf7cdf997dc4a8a409e80e658dded259ec1c32193f6dad6ab5c2b5f7N.exe
-
Size
208KB
-
MD5
70c6b88135d9beb37c1d8dce5a621be0
-
SHA1
87d03192463444a941f26ff7e2aaa77649a418b5
-
SHA256
aaed7210bf7cdf997dc4a8a409e80e658dded259ec1c32193f6dad6ab5c2b5f7
-
SHA512
e5cf626649dec02ec55925d14ce11cec17356e19c9c49bcc16b1b10690138b340b667aa6f0937aeab2429bf25a07e4202ef943089d9821847a2474713f9a118d
-
SSDEEP
6144:iZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq56:gquCuygMQjd5vJIBP1p
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 8 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaed7210bf7cdf997dc4a8a409e80e658dded259ec1c32193f6dad6ab5c2b5f7N.exe"C:\Users\Admin\AppData\Local\Temp\aaed7210bf7cdf997dc4a8a409e80e658dded259ec1c32193f6dad6ab5c2b5f7N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD552d9b20a3d92acee98d5ef8ef8e5326f
SHA1845d3528e317c37ee7bcbde4a501977a14e4713b
SHA256d4f20342502b1d69f5d15fe2ad1ef6fc92147c35e932960870cfd63eed647d6f
SHA512f021c98872e2d14bd1b7aaaef1e90e94ef460766b5292392c370c5bd39bf43895edc31f0164b135214182b7f310ffa48b3f2e94ad55e55b76c203f3b669a71e6
-
Filesize
564KB
-
Filesize
328KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
564KB
-
Filesize
564KB
-
Filesize
564KB
-
Filesize
564KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
564KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB