Overview

overview

10

Static

static

3

676fd10ce8...18.exe

windows7-x64

10

676fd10ce8...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 17:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    676fd10ce89a281c7ee790788617fa2af5cf19084177592e5dcc1f29f2254418.exe

  • Size

    1.1MB

  • MD5

    c6a85eeb49d74ce8f744d75a64e55afa

  • SHA1

    066a808d5010b975fe282435604aed71f144b140

  • SHA256

    676fd10ce89a281c7ee790788617fa2af5cf19084177592e5dcc1f29f2254418

  • SHA512

    1768d8307b6bb0201c8ddeb5f28d1ecf4f7aef2d34811966902731030203be8b431044fb709414e7edae475f0fffb05597ee3abe4ee61aa19c28627ea2305cfb

  • SSDEEP

    24576:L800kHPa2DfTNjx+mZCkt76f/24pN+XNqNG6hditWP:w0riKf9Ckt7c20+9qNxUWP

Score
10/10
simdadiscoverypersistencestealertrojan

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Simda family
    simda
  • simda

    Simda is an infostealer written in C++.

    stealertrojansimda
  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 38 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\676fd10ce89a281c7ee790788617fa2af5cf19084177592e5dcc1f29f2254418.exe
    "C:\Users\Admin\AppData\Local\Temp\676fd10ce89a281c7ee790788617fa2af5cf19084177592e5dcc1f29f2254418.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:672
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Windows Defender\galynuh.com
    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

    Download Submit

  • C:\Program Files (x86)\Windows Defender\galyqaz.com
    Filesize

    42KB

    MD5

    e7d9bafcdb808898576c6c8e1191c118

    SHA1

    c52825bad249c7d965628377aa8286f81f7cf2ff

    SHA256

    140d9f3f4cd06bbd9f8b9ec8c11648d1ce463b93e9eeed0a8d467970d60903b7

    SHA512

    c8dc067a07aa1a80ed2c0eda08a13e6bc29378accdf6d8e1af4d33f47dde93dac6f90db4c87ec655816d1af458f8174591ac8e202e08fd1799cbeb5efb96f92d

    Download Submit

  • C:\Program Files (x86)\Windows Defender\puzylyp.com
    Filesize

    58KB

    MD5

    ad14b2af4ca2b33a6786b98991f24983

    SHA1

    7bf2668bf15910cfb5999491f72d42e8afe1ed48

    SHA256

    03d9f0bc0c8ae60c5ec8011f690c0fa81ee7c2d8890ed9e33837c75af386bba6

    SHA512

    d29fbe28101f75c2f79a9f45f866b74318165481e1387d2a3182b5d4c559ca42b9f222caab75730b9550ce377fbcc09967c0e61fb0d968516d0558ca7336fee8

    Download Submit

  • C:\Program Files (x86)\Windows Defender\qexyhuv.com
    Filesize

    114B

    MD5

    bfde1e9e9c32c1681a16139450c6909d

    SHA1

    7e669b927e6a75a10a0ca29e38e58ddcb49b725e

    SHA256

    e0d020ba1cb6506cee234903a44c747ee0cfa7e2d1e60029e4cd8de9a431512a

    SHA512

    781fd54f155442dd34f9919b3cd063ee399db411bbfe15f2bdc43d3ab8ac2d04e1011b2c99fab42bebf7b903a94e09aaaef71b7a465d2d04b417f6dad8e8e396

    Download Submit

  • C:\Program Files (x86)\Windows Defender\vojyqem.com
    Filesize

    1KB

    MD5

    e5afd042d72ffde70c7cf798988c3d33

    SHA1

    fe8af611671c7a2a79b571ca15d8d1bcc9fb89e3

    SHA256

    aaa8c8d5bdd655885f86cad18158267102521c7da39cb6131dd4560eb12dd2ae

    SHA512

    272e056f201a22a95324e7bcec889b565fd7dca6eed2d063a7e78e5e100eded7015131875f4df5ca92d63834d66a9ed90f642456f17b6f3a19076ffb1738197e

    Download Submit

  • C:\Program Files (x86)\Windows Defender\vojyqem.com
    Filesize

    1KB

    MD5

    073b3e6a7886b1cd175085530ed8e3a6

    SHA1

    1dbe28c9b5ddeb171bf7f517a8f10337a4d5ec74

    SHA256

    82b38e289b1d2f237a6941733a8f11ae7f5d4f49aa90b126b9b529766fc3aed4

    SHA512

    f76a03b2e1574143b853f72fd1a71d40d4937c4477e474750fc91820f5d3a87d854c3c4a57493ce408e1483ab4801784bf25a3ffbcbb2a7bbe87c7d624f16145

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8B3ZU6S9\login[3].htm
    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8B3ZU6S9\login[4].htm
    Filesize

    593B

    MD5

    3b03d93d3487806337b5c6443ce7a62d

    SHA1

    93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

    SHA256

    7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

    SHA512

    770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGDWJGSY\login[3].htm
    Filesize

    114B

    MD5

    e89f75f918dbdcee28604d4e09dd71d7

    SHA1

    f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

    SHA256

    6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

    SHA512

    8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M6JHG9EK\login[5].htm
    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

    Download Submit

  • C:\Windows\apppatch\svchost.exe
    Filesize

    1.1MB

    MD5

    573a144a948df0ce58a7dd1ea66b11a4

    SHA1

    0d40380cf70f2bed89aeb865fe31f5185cfa8d3d

    SHA256

    b3d9e92b2b85ed520004ab5c0c4a0793d136a04e1e20a4dda6536f223c1c6c57

    SHA512

    4c54f1e011714b8f508eb956aed9682a64e3787db3dbfcc5112f121dfad2282d611bcfd76a0c981a6a8fa7bda0846e438ad03c322be8a09925271b677b77fddf

    Download Submit

  • memory/672-0-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/672-12-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/672-14-0x0000000002220000-0x000000000226F000-memory.dmp

    Filesize

    316KB

    Download

  • memory/672-15-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

    Download

  • memory/672-2-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

    Download

  • memory/672-1-0x0000000002220000-0x000000000226F000-memory.dmp

    Filesize

    316KB

    Download

  • memory/4600-62-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-51-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-31-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-26-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-54-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-56-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-69-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-79-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-78-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-77-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-76-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-75-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-74-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-73-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-72-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-71-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-70-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-68-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-67-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-66-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-65-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-64-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-63-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-22-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-61-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-59-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-58-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-57-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-55-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-53-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-52-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-36-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-50-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-49-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-48-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-47-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-60-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-46-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-45-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-44-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-43-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-42-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-41-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-40-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-39-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-38-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-37-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-35-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-34-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-33-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-32-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-30-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-29-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-28-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-24-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-20-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-19-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/4600-18-0x0000000002A10000-0x0000000002AB4000-memory.dmp

    Filesize

    656KB

    Download

  • memory/4600-17-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/4600-16-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/4600-13-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/4600-27-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4600-25-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download