Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31-12-2024 23:50

General

  • Target

    f706e61803d2b50e489839eef14992a9b705d848b8a0215f213157f322a0dd11N.exe

  • Size

    211KB

  • MD5

    12cbcb4b49e739acc7c7ddf0289515e0

  • SHA1

    66c4124810d1dc2f68fa1adda85cf9b1c1c71bfb

  • SHA256

    f706e61803d2b50e489839eef14992a9b705d848b8a0215f213157f322a0dd11

  • SHA512

    b19b169d435a2a8868758cddc2366f2e081a772e2a9d0e105c9c4d8ab4b626fb5acf05a477000c5ef7cbdf968751de1031210694a8a614e0ca12e5d8dc8e21b3

  • SSDEEP

    3072:Og/T01/NkSp48GzFoMVZrjB2+4M9eOpssvSX4FzU5chdhGulEV5SCmGFkInV/0at:3ErGjVqiFPGYrGZMCrCIn6aQdM

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 1 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f706e61803d2b50e489839eef14992a9b705d848b8a0215f213157f322a0dd11N.exe
    "C:\Users\Admin\AppData\Local\Temp\f706e61803d2b50e489839eef14992a9b705d848b8a0215f213157f322a0dd11N.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\AppPatch\svchost.exe

    Filesize

    211KB

    MD5

    e1855845d4656e23743cfa7eb13c66a0

    SHA1

    dc83742b79eea1957fe5a6deee35f5dd073d4314

    SHA256

    427c0e5354a2f696c9b36e6e1c562b9ff5e939c3f91924d0d0f8e7a1864b8b69

    SHA512

    cf3f5a8c2c57af412f0db47464d3287c7aaf9e49336972585be46939738fafe8fd5022a2be7cfc46986e1b12976f5cbb1bc9f29a644fdc2182ea74c3650afe8d

  • memory/1924-0-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/1924-1-0x0000000000270000-0x00000000002C2000-memory.dmp

    Filesize

    328KB

  • memory/1924-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1924-18-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/1924-20-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1924-19-0x0000000000270000-0x00000000002C2000-memory.dmp

    Filesize

    328KB

  • memory/2592-21-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/2592-22-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/2592-23-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/2592-26-0x0000000000490000-0x000000000053A000-memory.dmp

    Filesize

    680KB

  • memory/2592-32-0x0000000000490000-0x000000000053A000-memory.dmp

    Filesize

    680KB

  • memory/2592-30-0x0000000000490000-0x000000000053A000-memory.dmp

    Filesize

    680KB

  • memory/2592-35-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/2592-28-0x0000000000490000-0x000000000053A000-memory.dmp

    Filesize

    680KB

  • memory/2592-34-0x0000000000490000-0x000000000053A000-memory.dmp

    Filesize

    680KB

  • memory/2592-24-0x0000000000490000-0x000000000053A000-memory.dmp

    Filesize

    680KB

  • memory/2592-36-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-38-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-41-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-46-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-54-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-85-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-84-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-82-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-81-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-80-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-79-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-78-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-77-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-76-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-74-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-72-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-71-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-69-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-67-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-66-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-64-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-63-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-62-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-61-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-60-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-59-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-58-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-56-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-53-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-52-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-51-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-50-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-49-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-48-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-47-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-45-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-86-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-83-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-44-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-75-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-73-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-70-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-68-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-42-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-65-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-57-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-55-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB

  • memory/2592-43-0x0000000002400000-0x00000000024B7000-memory.dmp

    Filesize

    732KB