Overview

overview

10

Static

static

3

dff1c3d444...46.exe

windows7-x64

10

dff1c3d444...46.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/11/2024, 06:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dff1c3d444576f4f0a1ef114c41ad934634c3f0a5fc94f925a3ed7caac4a6c46.exe

  • Size

    205KB

  • MD5

    d9394dfc0d73164ac0134fe3e7f47cc0

  • SHA1

    9ed038f8c4224e444e26cf6442015452b24ec0d0

  • SHA256

    dff1c3d444576f4f0a1ef114c41ad934634c3f0a5fc94f925a3ed7caac4a6c46

  • SHA512

    b6aa785c02c4818a5cab67ffe848d2f60ca6a18ff363928634f381282803c28ea0dffac9975434765a89daba6f748f173c42735e1bba8076d99473e29110eda7

  • SSDEEP

    3072:S7VD4DUHnNZkfOP6sfIOpJ9C3hPlGxt1UhRkgyankTIzfwAYzWcXCyqT36zhRRKy:IzHnMLm5GNGxHUhtnkdpHqTKzhh8i

Score
10/10
simdadiscoverypersistencestealertrojan

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Simda family
    simda
  • simda

    Simda is an infostealer written in C++.

    stealertrojansimda
  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 36 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dff1c3d444576f4f0a1ef114c41ad934634c3f0a5fc94f925a3ed7caac4a6c46.exe
    "C:\Users\Admin\AppData\Local\Temp\dff1c3d444576f4f0a1ef114c41ad934634c3f0a5fc94f925a3ed7caac4a6c46.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3276

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Windows Defender\galyqaz.com
    Filesize

    42KB

    MD5

    7cba6da95dd111cd4ad24069d3015198

    SHA1

    5877776eabe7ed974e1185c813a6b406e3b6409e

    SHA256

    a9896e59827dbc5d2aeb54e6f4c0749e4c8b59acbdd2d0677fe4fe6bcd058de5

    SHA512

    18c091df7e75e2694ac381b95e5c8046ccbece70c9b3969fc352521349454f861a28aa18a18519b248016c3fda47d9728e8173015eb7283b1df53340eabb0b2b

    Download Submit

  • C:\Program Files (x86)\Windows Defender\pupydeq.com
    Filesize

    114B

    MD5

    bfde1e9e9c32c1681a16139450c6909d

    SHA1

    7e669b927e6a75a10a0ca29e38e58ddcb49b725e

    SHA256

    e0d020ba1cb6506cee234903a44c747ee0cfa7e2d1e60029e4cd8de9a431512a

    SHA512

    781fd54f155442dd34f9919b3cd063ee399db411bbfe15f2bdc43d3ab8ac2d04e1011b2c99fab42bebf7b903a94e09aaaef71b7a465d2d04b417f6dad8e8e396

    Download Submit

  • C:\Program Files (x86)\Windows Defender\puzylyp.com
    Filesize

    61KB

    MD5

    c48c6e69ca5d62278854e0cb82c7e8f7

    SHA1

    ad52a2d3b56149d51b4eff3fceff91f56fe3d346

    SHA256

    64cb837648eebf8c4c907ddae4b3399c273be4bc526d42b1d6ba75e921d7f6b3

    SHA512

    0c089073f9572c344ff5b400758ddf2b88fe04575d944a585280c7ee4736848870a1385ee35a323b7dffde9a8889e6d9c0bf0d19ec1fcea8014fd44a6d048460

    Download Submit

  • C:\Program Files (x86)\Windows Defender\qetyhyg.com
    Filesize

    593B

    MD5

    3b03d93d3487806337b5c6443ce7a62d

    SHA1

    93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

    SHA256

    7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

    SHA512

    770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

    Download Submit

  • C:\Program Files (x86)\Windows Defender\qetyhyg.com
    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

    Download Submit

  • C:\Program Files (x86)\Windows Defender\vojyqem.com
    Filesize

    1KB

    MD5

    f25f6e41e2d4f83fbec5759229891ef2

    SHA1

    272a820f2a31d7e3c165bb9f16bc72188e8362f7

    SHA256

    36f2e6af98fc96f7077a35e6ab4efee862b8e8a26e363537316e0fe9eb08ec4a

    SHA512

    c00e8625df8041eae2c3d9579856a24da6afb03eb6374a1850e0a70e14295e277ddcbf8227693f8df1db8ab9f91e4fe6a486a1e1be6219f1d12fdd025d921b75

    Download Submit

  • C:\Program Files (x86)\Windows Defender\vojyqem.com
    Filesize

    1KB

    MD5

    b65fa250bdd10fd23c4f79dd7826cc8b

    SHA1

    3ed3a531a9f3e7b47b12f76742e0b3c1fccdfe8d

    SHA256

    c1ec69f98f8ef9bb2c8808ab19d113f8c9af7f3aa9b78011fcbb123c9ebe95b7

    SHA512

    ef26c15710f110494788d7788de9700aa062dac6a40623aeba4d69ffa2567d046509e82cebecbcc24ab92f9bbe829598127982312cf9645b32f77c7641996ab0

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FMGLWGAG\login[3].htm
    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V4KZV1MD\login[2].htm
    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YY018DS9\login[3].htm
    Filesize

    114B

    MD5

    e89f75f918dbdcee28604d4e09dd71d7

    SHA1

    f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

    SHA256

    6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

    SHA512

    8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

    Download Submit

  • C:\Windows\apppatch\svchost.exe
    Filesize

    205KB

    MD5

    1641d2153f50903e0d0ec0e15a24730b

    SHA1

    f6bbece6c0a59539c26482625fce4c2340d41215

    SHA256

    d529d834232d6016451efdac62972e0404cb4dc697192737c593ff4edff2e1c4

    SHA512

    a904f68e57ac114465238a7a9685cd57e5b408b93fdaa1a3c008f93fac956f1c50639cf547dc1b62f7b5581ddf9ef5a515a3b6e7c485c95d837f3be51282d243

    Download Submit

  • memory/1680-13-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/1680-14-0x0000000002260000-0x00000000022AF000-memory.dmp

    Filesize

    316KB

    Download

  • memory/1680-15-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

    Download

  • memory/1680-2-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

    Download

  • memory/1680-1-0x0000000002260000-0x00000000022AF000-memory.dmp

    Filesize

    316KB

    Download

  • memory/1680-0-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/3276-54-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-44-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-78-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-77-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-76-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-74-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-73-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-72-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-71-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-70-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-69-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-68-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-67-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-66-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-65-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-63-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-62-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-60-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-59-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-58-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-57-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-56-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-55-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-53-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-52-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-51-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-50-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-49-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-48-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-47-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-45-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-79-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-43-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-42-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-41-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-40-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-39-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-38-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-37-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-36-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-35-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-34-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-33-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-32-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-31-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-29-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-28-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-27-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-75-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-26-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-64-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-61-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-25-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-46-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-22-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-24-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-20-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3276-19-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/3276-18-0x0000000002A90000-0x0000000002B34000-memory.dmp

    Filesize

    656KB

    Download

  • memory/3276-17-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/3276-16-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/3276-12-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/3276-30-0x0000000002C40000-0x0000000002CF2000-memory.dmp

    Filesize

    712KB

    Download