Overview

overview

10

Static

static

3

01bfe9ccc5...0N.exe

windows7-x64

10

01bfe9ccc5...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2024 16:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    01bfe9ccc59dbc13b289725b36830e5c17ac2e7a496ac4f06ca7cf0c73db5e80N.exe

  • Size

    205KB

  • MD5

    296722b7ad4be51557b5027d24a352f0

  • SHA1

    1326930cffc9b9be0411b468ee09b5e2719eab4a

  • SHA256

    01bfe9ccc59dbc13b289725b36830e5c17ac2e7a496ac4f06ca7cf0c73db5e80

  • SHA512

    18c3ec716fa8a00475f13793c86061bd056ba20d2214e4bcbda5e088ffd8b365cc9a7c0cc4f6e470a6586ba6afb30ecb19abf89868931b91a51f14184b0d7d02

  • SSDEEP

    3072:s7VD4DUHnNZkfOP6sfIOpJ9C3hPlGxt1UhRkgyankTIzfwAYzWcXCyqT36zhRRKy:CzHnMLm5GNGxHUhtnkdpHqTKzhh8i

Score
10/10
simdadiscoverypersistencestealertrojan

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Simda family
    simda
  • simda

    Simda is an infostealer written in C++.

    stealertrojansimda
  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 42 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01bfe9ccc59dbc13b289725b36830e5c17ac2e7a496ac4f06ca7cf0c73db5e80N.exe
    "C:\Users\Admin\AppData\Local\Temp\01bfe9ccc59dbc13b289725b36830e5c17ac2e7a496ac4f06ca7cf0c73db5e80N.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Windows Defender\galyqaz.com
    Filesize

    42KB

    MD5

    4cfd8ef6adfada62aa4c9db417ff8dd7

    SHA1

    7be38c15db0763d8b88b76f4b9ba0c7d53f3d53f

    SHA256

    71e8dddc1eea455e12bbc9d309f44eebb82ece5b399efd2995f2f9c49ad2e652

    SHA512

    d4627d8c0d7dd506f86408579dfffa5568ad34dd1b39e97c4d8704bc968424a4389d5764bf7cb72bfd8d6ade5f09a3f49c43c0666cfe9374871f1b955271e3c8

    Download Submit

  • C:\Program Files (x86)\Windows Defender\lysyfyj.com
    Filesize

    481B

    MD5

    4abf43b66aca5be55be093bc2ef5b24f

    SHA1

    89957f0f62a75833626617fc8fac01874e839c6c

    SHA256

    f530db3de2a600f219e1fb6f1866e434bae877d84cd420b3dabf3b676f06c08e

    SHA512

    efa963bdfabf859367ea87ffa6e5ddf6fe629f6bbe749fbcd788fb6fc5293a6aff79a8e7e5e82778117debb98f152af4edb76bd13492d2c1ca4d6637b2d3220e

    Download Submit

  • C:\Program Files (x86)\Windows Defender\puzylyp.com
    Filesize

    61KB

    MD5

    c2c7c49fd9caf2ea9c91f0bd9c6ff68c

    SHA1

    fa274a622c3a734254ee318606152ae3d7f2c378

    SHA256

    a11c1f6744832f54a00249fcc8d677571772f81b30a1751be4898df3fab56c93

    SHA512

    a1691e0263fcca88056d67dbc53b9312ffe9c4915e20f665e127d17b08840ce4281a73637ffff071bb7343339f14c7ebaeb23ab319a576f2515ba97661089b2e

    Download Submit

  • C:\Program Files (x86)\Windows Defender\qetyhyg.com
    Filesize

    593B

    MD5

    3b03d93d3487806337b5c6443ce7a62d

    SHA1

    93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

    SHA256

    7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

    SHA512

    770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

    Download Submit

  • C:\Program Files (x86)\Windows Defender\qetyhyg.com
    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

    Download Submit

  • C:\Program Files (x86)\Windows Defender\qexyhuv.com
    Filesize

    114B

    MD5

    e89f75f918dbdcee28604d4e09dd71d7

    SHA1

    f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

    SHA256

    6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

    SHA512

    8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

    Download Submit

  • C:\Program Files (x86)\Windows Defender\qexyhuv.com
    Filesize

    114B

    MD5

    bfde1e9e9c32c1681a16139450c6909d

    SHA1

    7e669b927e6a75a10a0ca29e38e58ddcb49b725e

    SHA256

    e0d020ba1cb6506cee234903a44c747ee0cfa7e2d1e60029e4cd8de9a431512a

    SHA512

    781fd54f155442dd34f9919b3cd063ee399db411bbfe15f2bdc43d3ab8ac2d04e1011b2c99fab42bebf7b903a94e09aaaef71b7a465d2d04b417f6dad8e8e396

    Download Submit

  • C:\Program Files (x86)\Windows Defender\vojyqem.com
    Filesize

    1KB

    MD5

    40c03317470ca0db905cf9d9df02ee21

    SHA1

    3217a6e896d0749077e394b0e9492bc1551148a8

    SHA256

    1fc8cfe6cf39bfc1d0f0d3c386a81c8debfb6db9c7639e06d881c663da78271a

    SHA512

    b506cc11630e64d03e252468994ec6af327b4aa59e10e2b760fcaa06866ef1d80f6d1b17e60df620c9a16c7dac6f1b90090c79e88246c96520f8374835c4fb6e

    Download Submit

  • C:\Program Files (x86)\Windows Defender\vojyqem.com
    Filesize

    1KB

    MD5

    b11eddd42a39a7a20f966f53181ca4ae

    SHA1

    3518d84d2764544e6b0f22e54321a2cc04c8fcbf

    SHA256

    5dd405d0dba9aa484b90f53003f0af8a34ab76faa3d8c29c076987abdd68a7ae

    SHA512

    97a4b918b825b6c5a4db3349c4bdea159e059bf087af64dd9a61b67a3e9ae211f826a59a2af3cea4fff105aff5ddc1093aae49dfd8cd4fbc6fd5198575c5fbf8

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EFY08QA2\login[1].htm
    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

    Download Submit

  • C:\Windows\apppatch\svchost.exe
    Filesize

    205KB

    MD5

    2de0ecc80980c32a8236ca2fb2218cea

    SHA1

    78b2ba5dfbee58d44eab0c3e74731b32a16473f8

    SHA256

    e512346412293a1fcfe32fad8c7458645b21d93845d120d6bb152f8931ef97ff

    SHA512

    9e8d7d1e2a7c1ec6d5aa5289cb4ca2d074b80692392b562d218945bc5240be42ea0b9438254e8b47860f5e6d8cf79a37ff904590b00098643fbebf84be601c0d

    Download Submit

  • memory/1104-50-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-44-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-68-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-79-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-78-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-77-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-76-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-75-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-74-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-73-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-72-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-71-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-70-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-69-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-67-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-66-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-64-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-63-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-62-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-61-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-60-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-58-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-57-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-56-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-55-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-54-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-53-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-52-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-51-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-24-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-49-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-48-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-47-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-46-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-45-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-22-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-43-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-41-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-40-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-39-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-38-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-37-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-36-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-35-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-34-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-33-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-32-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-31-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-30-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-29-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-28-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-26-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-25-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-65-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-59-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-42-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-27-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-20-0x0000000002C00000-0x0000000002CB2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1104-19-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/1104-16-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/1104-13-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/1104-17-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/1104-18-0x0000000002A10000-0x0000000002AB4000-memory.dmp

    Filesize

    656KB

    Download

  • memory/2296-0-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/2296-1-0x0000000002260000-0x00000000022AF000-memory.dmp

    Filesize

    316KB

    Download

  • memory/2296-2-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

    Download

  • memory/2296-15-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

    Download

  • memory/2296-14-0x0000000002260000-0x00000000022AF000-memory.dmp

    Filesize

    316KB

    Download

  • memory/2296-12-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

    Download