simda | 0c595ae8175b3eca651908cfdcaab87af3521bf1952e9ac90978b99cd1dd80b3

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2024 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c595ae8175b3eca651908cfdcaab87af3521bf1952e9ac90978b99cd1dd80b3.exe
Size

205KB
MD5

c902ca868a0647a4741a8f55ce4c0564
SHA1

a1ecce9cff93c010c3bed122eaedfe1073fd6691
SHA256

0c595ae8175b3eca651908cfdcaab87af3521bf1952e9ac90978b99cd1dd80b3
SHA512

0b000bb31e78c0915e0955dcfbbf4d0994a00016555f19c4c5201d7d62eaec8e3660a9df22e54819ffc66b63f0c96a1c00bdc32b28bad35b571b4d2e4b38244d
SSDEEP

3072:s7VD4DUHnNZkfOP6sfIOpJ9C3hPlGxt1UhRkgyankTIzfwAYzWcXCyqT36zhRRKC:CzHnMLm5GNGxHUhtnkdpHqTKzhh8y

Score

10^/10

simda discovery persistence stealer trojan

Malware Config

Extracted

Family

simda

Attributes

dga
gatyfus.com

lyvyxor.com

vojyqem.com

qetyfuv.com

puvyxil.com

gahyqah.com

lyryfyd.com

vocyzit.com

qegyqaq.com

purydyv.com

gacyzuz.com

lygymoj.com

vowydef.com

qexylup.com

pufymoq.com

gaqydeb.com

lyxylux.com

vofymik.com

qeqysag.com

puzylyp.com

gadyniw.com

lymysan.com

volykyc.com

qedynul.com

pumypog.com

galykes.com

lysynur.com

vonypom.com

qekykev.com

pupybul.com

ganypih.com

lykyjad.com

vopybyt.com

qebytiq.com

pujyjav.com

gatyvyz.com

lyvytuj.com

vojyjof.com

qetyvep.com

puvytuq.com

gahyhob.com

lyryvex.com

vocyruk.com

qegyhig.com

purycap.com

gacyryw.com

lygygin.com

vowycac.com

qexyryl.com

pufygug.com

gaqycos.com

lyxywer.com

vofygum.com

qeqyxov.com

puzywel.com

gadyfuh.com

lymyxid.com

volyqat.com

qedyfyq.com

pumyxiv.com

galyqaz.com

lysyfyj.com

vonyzuf.com

qekyqop.com

pupydeq.com

ganyzub.com

lykymox.com

vopydek.com

qebylug.com

pujymip.com

gatydaw.com

lyvylyn.com

vojymic.com

qetysal.com

puvylyg.com

gahynus.com

lyrysor.com

vocykem.com

qegynuv.com

purypol.com

gacykeh.com

lygynud.com

vowypit.com

qexykaq.com

pufybyv.com

gaqypiz.com

lyxyjaj.com

vofybyf.com

qeqytup.com

puzyjoq.com

gadyveb.com

lymytux.com

volyjok.com

qedyveg.com

pumytup.com

galyhiw.com

lysyvan.com

vonyryc.com

qekyhil.com

pupycag.com

ganyrys.com

lykygur.com

vopycom.com

qebyrev.com

pujygul.com

gatycoh.com

lyvywed.com

vojygut.com

qetyxiq.com

puvywav.com

gahyfyz.com

lyryxij.com

vocyqaf.com

qegyfyp.com

puryxuq.com

gacyqob.com

lygyfex.com

vowyzuk.com

qexyqog.com

pufydep.com

gaqyzuw.com

lyxymin.com

vofydac.com

qeqylyl.com

puzymig.com

gadydas.com

lymylyr.com

volymum.com

qedysov.com

pumylel.com

galynuh.com

lysysod.com

vonyket.com

qekynuq.com

pupypiv.com

ganykaz.com

lykynyj.com

vopypif.com

qebykap.com

pujybyq.com

gatypub.com

lyvyjox.com

vojybek.com

qetytug.com

puvyjop.com

gahyvew.com

lyrytun.com

vocyjic.com

qegyval.com

purytyg.com

gacyhis.com

lygyvar.com

vowyrym.com

qexyhuv.com

pufycol.com

gaqyreh.com

lyxygud.com

vofycot.com

qeqyreq.com

puzyguv.com

gadyciz.com

lymywaj.com

volygyf.com

qedyxip.com

pumywaq.com

galyfyb.com

lysyxux.com

vonyqok.com

qekyfeg.com

pupyxup.com

ganyqow.com

lykyfen.com

vopyzuc.com

qebyqil.com

pujydag.com

gatyzys.com

lyvymir.com

vojydam.com

qetylyv.com

puvymul.com

gahydoh.com

lyryled.com

vocymut.com

qegysoq.com

purylev.com

gacynuz.com

lygysij.com

vowykaf.com

qexynyp.com

pufypiq.com

gaqykab.com

lyxynyx.com

vofypuk.com

qeqykog.com

puzybep.com

gadypuw.com

lymyjon.com

volybec.com

qedytul.com

pumyjig.com

galyvas.com

lysytyr.com

vonyjim.com

qekyvav.com

pupytyl.com

ganyhuh.com

lykyvod.com

vopyret.com

qebyhuq.com

pujycov.com

gatyrez.com

lyvyguj.com

vojycif.com

qetyrap.com

puvygyq.com

gahycib.com

lyrywax.com

vocygyk.com

qegyxug.com

purywop.com

gacyfew.com

lygyxun.com

vowyqoc.com

qexyfel.com

pufyxug.com

gaqyqis.com

lyxyfar.com

vofyzym.com

qeqyqiv.com

puzydal.com

gadyzyh.com

lymymud.com

volydot.com

qedyleq.com

pumymuv.com

galydoz.com

lysylej.com

vonymuf.com

qekysip.com

pupylaq.com

ganynyb.com

lykysix.com

vopykak.com

qebynyg.com

pujypup.com

gatykow.com

lyvynen.com

vojypuc.com

qetykol.com

puvybeg.com

gahypus.com

lyryjir.com

vocybam.com

qegytyv.com

puryjil.com

gacyvah.com

lygytyd.com

vowyjut.com

qexyvoq.com

pufytev.com

gaqyhuz.com

lyxyvoj.com

vofyref.com

qeqyhup.com

puzyciq.com

gadyrab.com

lymygyx.com

volycik.com

qedyrag.com

pumygyp.com

galycuw.com

lysywon.com

vonygec.com

qekyxul.com

pupywog.com

ganyfes.com

lykyxur.com

vopyqim.com

qebyfav.com

pujyxyl.com

gatyqih.com

lyvyfad.com

vojyzyt.com

qetyquq.com

puvydov.com

gahyzez.com

lyrymuj.com

vocydof.com

qegylep.com

purymuq.com

gacydib.com

lygylax.com

vowymyk.com

qexysig.com

pufylap.com

gaqynyw.com

lyxysun.com

vofykoc.com

qeqynel.com

puzypug.com

gadykos.com

lymyner.com

volypum.com

qedykiv.com

pumybal.com

galypyh.com

lysyjid.com

vonybat.com

qekytyq.com

pupyjuv.com

ganyvoz.com

lykytej.com

vopyjuf.com

qebyvop.com

pujyteq.com

gatyhub.com

lyvyvix.com

vojyrak.com

qetyhyg.com

puvycip.com

gahyraw.com

lyrygyn.com

vocycuc.com

qegyrol.com

purygeg.com

gacycus.com

lygywor.com

vowygem.com

qexyxuv.com

pufywil.com

gaqyfah.com

lyxyxyd.com

vofyqit.com

qeqyfaq.com

puzyxyv.com

gadyquz.com

lymyfoj.com

volyzef.com

qedyqup.com

pumydoq.com

galyzeb.com

lysymux.com

vonydik.com

qekylag.com

pupymyp.com

ganydiw.com

lykylan.com

vopymyc.com

qebysul.com

pujylog.com

gatynes.com

lyvysur.com

vojykom.com

qetynev.com

puvypul.com

gahykih.com

lyrynad.com

vocypyt.com

qegykiq.com

purybav.com

gacypyz.com

lygyjuj.com

vowybof.com

qexytep.com

pufyjuq.com

gaqyvob.com

lyxytex.com

vofyjuk.com

qeqyvig.com

puzytap.com

gadyhyw.com

lymyvin.com

volyrac.com

qedyhyl.com

pumycug.com

galyros.com

lysyger.com

vonycum.com

qekyrov.com

pupygel.com

ganycuh.com

lykywid.com

vopygat.com

qebyxyq.com

pujywiv.com

gatyfaz.com

lyvyxyj.com

vojyquf.com

qetyfop.com

puvyxeq.com

gahyqub.com

lyryfox.com

vocyzek.com

qegyqug.com

purydip.com

gacyzaw.com

lygymyn.com

vowydic.com

qexylal.com

pufymyg.com

gaqydus.com

lyxylor.com

vofymem.com

qeqysuv.com

puzylol.com

gadyneh.com

lymysud.com

volykit.com

qedynaq.com

pumypyv.com

galykiz.com

lysynaj.com

vonypyf.com

qekykup.com

pupyboq.com

ganypeb.com

lykyjux.com

vopybok.com

qebyteg.com

pujyjup.com

gatyviw.com

lyvytan.com

vojyjyc.com

qetyvil.com

puvytag.com

gahyhys.com

lyryvur.com

vocyrom.com

qegyhev.com

purycul.com

gacyroh.com

lygyged.com

vowycut.com

qexyriq.com

pufygav.com

gaqycyz.com

lyxywij.com

vofygaf.com

qeqyxyp.com

puzywuq.com

gadyfob.com

lymyxex.com

volyquk.com

qedyfog.com

pumyxep.com

galyquw.com

lysyfin.com

vonyzac.com

qekyqyl.com

pupydig.com

ganyzas.com

lykymyr.com

vopydum.com

qebylov.com

pujymel.com

gatyduh.com

lyvylod.com

vojymet.com

qetysuq.com

puvyliv.com

gahynaz.com

lyrysyj.com

vocykif.com

qegynap.com

purypyq.com

gacykub.com

lygynox.com

vowypek.com

qexykug.com

pufybop.com

gaqypew.com

lyxyjun.com

vofybic.com

qeqytal.com

puzyjyg.com

gadyvis.com

lymytar.com

volyjym.com

qedyvuv.com

pumytol.com

galyheh.com

lysyvud.com

vonyrot.com

qekyheq.com

pupycuv.com

ganyriz.com

lykygaj.com

vopycyf.com

qebyrip.com

pujygaq.com

gatycyb.com

lyvywux.com

vojygok.com

qetyxeg.com

puvywup.com

gahyfow.com

lyryxen.com

vocyquc.com

qegyfil.com

puryxag.com

gacyqys.com

lygyfir.com

vowyzam.com

qexyqyv.com

pufydul.com

gaqyzoh.com

lyxymed.com

vofydut.com

qeqyloq.com

puzymev.com

gadyduz.com

lymylij.com

volymaf.com

qedysyp.com

pumyliq.com

galynab.com

lysysyx.com

vonykuk.com

qekynog.com

pupypep.com

ganykuw.com

lykynon.com

vopypec.com

qebykul.com

pujybig.com

gatypas.com

lyvyjyr.com

vojybim.com

qetytav.com

puvyjyl.com

gahyvuh.com

lyrytod.com

vocyjet.com

qegyvuq.com

purytov.com

gacyhez.com

lygyvuj.com

vowyrif.com

qexyhap.com

pufycyq.com

gaqyrib.com

lyxygax.com

vofycyk.com

qeqyrug.com

puzygop.com

gadycew.com

lymywun.com

volygoc.com

qedyxel.com

pumywug.com

galyfis.com

lysyxar.com

vonyqym.com

qekyfiv.com

pupyxal.com

ganyqyh.com

lykyfud.com

vopyzot.com

qebyqeq.com

pujyduv.com

gatyzoz.com

lyvymej.com

vojyduf.com

qetylip.com

puvymaq.com

gahydyb.com

lyrylix.com

vocymak.com

qegysyg.com

purylup.com

gacynow.com

lygysen.com

vowykuc.com

qexynol.com

pufypeg.com

gaqykus.com

lyxynir.com

vofypam.com

qeqykyv.com

puzybil.com

gadypah.com

lymyjyd.com

volybut.com

qedytoq.com

pumyjev.com

galyvuz.com

lysytoj.com

vonyjef.com

qekyvup.com

pupytiq.com

ganyhab.com

lykyvyx.com

vopyrik.com

qebyhag.com

pujycyp.com

gatyruw.com

lyvygon.com

vojycec.com

qetyrul.com

puvygog.com

gahyces.com

lyrywur.com

vocygim.com

qegyxav.com

purywyl.com

gacyfih.com

lygyxad.com

vowyqyt.com

qexyfuq.com

pufyxov.com

gaqyqez.com

lyxyfuj.com

vofyzof.com

qeqyqep.com

puzyduq.com

gadyzib.com

lymymax.com

volydyk.com

qedylig.com

pumymap.com

galydyw.com

lysylun.com

vonymoc.com

qekysel.com

pupylug.com

ganynos.com

lykyser.com

vopykum.com

qebyniv.com

pujypal.com

gatykyh.com

lyvynid.com

vojypat.com

qetykyq.com

puvybuv.com

gahypoz.com

lyryjej.com

vocybuf.com

qegytop.com

puryjeq.com

gacyvub.com

lygytix.com

vowyjak.com

qexyvyg.com

pufytip.com

gaqyhaw.com

lyxyvyn.com

vofyruc.com

qeqyhol.com

puzyceg.com

gadyrus.com

lymygor.com

volycem.com

qedyruv.com

pumygil.com

galycah.com

lysywyd.com

vonygit.com

qekyxaq.com

pupywyv.com

ganyfuz.com

lykyxoj.com

vopyqef.com

qebyfup.com

pujyxoq.com

gatyqeb.com

lyvyfux.com

vojyzik.com

qetyqag.com

puvydyp.com

gahyziw.com

lyryman.com

vocydyc.com

qegylul.com

purymog.com

gacydes.com

lygylur.com

vowymom.com

qexysev.com

pufylul.com

gaqynih.com

lyxysad.com

vofykyt.com

qeqyniq.com

puzypav.com

gadykyz.com

lymynuj.com

volypof.com

qedykep.com

pumybuq.com

galypob.com

lysyjex.com

vonybuk.com

qekytig.com

pupyjap.com

ganyvyw.com

lykytin.com

vopyjac.com

qebyvyl.com

pujytug.com

gatyhos.com

lyvyver.com

vojyrum.com

qetyhov.com

puvycel.com

gahyruh.com

lyrygid.com

vocycat.com

qegyryq.com

purygiv.com

gacycaz.com

lygywyj.com

vowyguf.com

qexyxop.com

pufyweq.com

gaqyfub.com

lyxyxox.com

vofyqek.com

qeqyfug.com

puzyxip.com

gadyqaw.com

lymyfyn.com

volyzic.com

qedyqal.com

pumydyg.com

galyzus.com

lysymor.com

vonydem.com

qekyluv.com

pupymol.com

ganydeh.com

lykylud.com

vopymit.com

qebysaq.com

pujylyv.com

gatyniz.com

lyvysaj.com

vojykyf.com

qetynup.com

puvypoq.com

gahykeb.com

lyrynux.com

vocypok.com

qegykeg.com

purybup.com

gacypiw.com

lygyjan.com

vowybyc.com

qexytil.com

pufyjag.com

gaqyvys.com

lyxytur.com

vofyjom.com

qeqyvev.com

puzytul.com

gadyhoh.com

lymyved.com

volyrut.com

qedyhiq.com

pumycav.com

galyryz.com

lysygij.com

vonycaf.com

qekyryp.com

pupyguq.com

ganycob.com

lykywex.com

vopyguk.com

qebyxog.com

pujywep.com

gatyfuw.com

lyvyxin.com

vojyqac.com

qetyfyl.com

puvyxig.com

gahyqas.com

lyryfyr.com

vocyzum.com

qegyqov.com

purydel.com

gacyzuh.com

lygymod.com

vowydet.com

qexyluq.com

pufymiv.com

gaqydaz.com

lyxylyj.com

vofymif.com

qeqysap.com

puzylyq.com

gadynub.com

lymysox.com

volykek.com

qedynug.com

pumypop.com

galykew.com

lysynun.com

vonypic.com

qekykal.com

pupybyg.com

ganypis.com

lykyjar.com

vopybym.com

qebytuv.com

pujyjol.com

gatyveh.com

lyvytud.com

vojyjot.com

qetyveq.com

puvytuv.com

gahyhiz.com

lyryvaj.com

vocyryf.com

qegyhip.com

purycaq.com

gacyryb.com

lygygux.com

vowycok.com

qexyreg.com

pufygup.com

gaqycow.com

lyxywen.com

vofyguc.com

qeqyxil.com

puzywag.com

gadyfys.com

lymyxir.com

volyqam.com

qedyfyv.com

pumyxul.com

galyqoh.com

lysyfed.com

vonyzut.com

qekyqoq.com

pupydev.com

ganyzuz.com

lykymij.com

vopydaf.com

qebylyp.com

pujymiq.com

gatydab.com

lyvylyx.com

vojymuk.com

qetysog.com

puvylep.com

gahynuw.com

lyryson.com

vocykec.com

qegynul.com

purypig.com

gacykas.com

lygynyr.com

vowypim.com

qexykav.com

pufybyl.com

gaqypuh.com

lyxyjod.com

vofybet.com

qeqytuq.com

puzyjov.com

gadyvez.com

lymytuj.com

volyjif.com

qedyvap.com

pumytyq.com

galyhib.com

lysyvax.com

vonyryk.com

qekyhug.com

pupycop.com

ganyrew.com

lykygun.com

vopycoc.com

qebyrel.com

pujygug.com

gatycis.com

lyvywar.com

vojygym.com

qetyxiv.com

puvywal.com

gahyfyh.com

lyryxud.com

vocyqot.com

qegyfeq.com

puryxuv.com

gacyqoz.com

lygyfej.com

vowyzuf.com

qexyqip.com

pufydaq.com

gaqyzyb.com

lyxymix.com

vofydak.com

qeqylyg.com

puzymup.com

gadydow.com

lymylen.com

volymuc.com

qedysol.com

pumyleg.com

galynus.com

lysysir.com

vonykam.com

qekynyv.com

pupypil.com

ganykah.com

lykynyd.com

vopyput.com

qebykoq.com

pujybev.com

gatypuz.com

lyvyjoj.com

vojybef.com

qetytup.com

puvyjiq.com

gahyvab.com

lyrytyx.com

vocyjik.com

qegyvag.com

purytyp.com

gacyhuw.com

lygyvon.com

vowyrec.com

qexyhul.com

pufycog.com

gaqyres.com

lyxygur.com

vofycim.com

qeqyrav.com

puzygyl.com

gadycih.com

lymywad.com

volygyt.com

qedyxuq.com

pumywov.com

galyfez.com

lysyxuj.com

vonyqof.com

qekyfep.com

pupyxuq.com

ganyqib.com

lykyfax.com

vopyzyk.com

qebyqig.com

pujydap.com

gatyzyw.com

lyvymun.com

vojydoc.com

qetylel.com

puvymug.com

gahydos.com

lyryler.com

vocymum.com

qegysiv.com

purylal.com

gacynyh.com

lygysid.com

vowykat.com

qexynyq.com

pufypuv.com

gaqykoz.com

lyxynej.com

vofypuf.com

qeqykop.com

puzybeq.com

gadypub.com

lymyjix.com

volybak.com

qedytyg.com

pumyjip.com

galyvaw.com

lysytyn.com

vonyjuc.com

qekyvol.com

pupyteg.com

ganyhus.com

lykyvor.com

vopyrem.com

qebyhuv.com

pujycil.com

gatyrah.com

lyvygyd.com

vojycit.com

qetyraq.com

puvygyv.com

gahycuz.com

lyrywoj.com

vocygef.com

qegyxup.com

purywoq.com

gacyfeb.com

lygyxux.com

vowyqik.com

qexyfag.com

pufyxyp.com

gaqyqiw.com

lyxyfan.com

vofyzyc.com

qeqyqul.com

puzydog.com

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Simda family
simda
simda
Simda is an infostealer written in C++.
stealer trojan simda

Executes dropped EXE 1 IoCs

pid	Process
4164	svchost.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\50744f7a = "C:\\Windows\\apppatch\\svchost.exe"	0c595ae8175b3eca651908cfdcaab87af3521bf1952e9ac90978b99cd1dd80b3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\50744f7a = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Program Files directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Defender\vojyqem.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\puzylyp.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\pupycag.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\gadyciz.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\galynuh.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\vocyzit.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\gatyfus.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\lyxynyx.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\qetyhyg.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\lygyvuj.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\gatyhub.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\puzylyp.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\galyqaz.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\pupycag.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\galynuh.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\vofycot.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\lyxynyx.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\gahyqah.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\gatyfus.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\pupydeq.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\lygyvuj.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\gahyhiz.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\qetyfuv.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\vonypom.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\vocyzit.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\qetyhyg.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\vojyqem.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\gahyqah.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\gadyciz.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\vofycot.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\gatyhub.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\qexyhuv.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\gahyhiz.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\qetyfuv.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\vonypom.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\galyqaz.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\pupydeq.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\qexyhuv.com	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	0c595ae8175b3eca651908cfdcaab87af3521bf1952e9ac90978b99cd1dd80b3.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	0c595ae8175b3eca651908cfdcaab87af3521bf1952e9ac90978b99cd1dd80b3.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4692	4164	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c595ae8175b3eca651908cfdcaab87af3521bf1952e9ac90978b99cd1dd80b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4164	svchost.exe
4164	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3944	0c595ae8175b3eca651908cfdcaab87af3521bf1952e9ac90978b99cd1dd80b3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 4164	3944	0c595ae8175b3eca651908cfdcaab87af3521bf1952e9ac90978b99cd1dd80b3.exe	83
PID 3944 wrote to memory of 4164	3944	0c595ae8175b3eca651908cfdcaab87af3521bf1952e9ac90978b99cd1dd80b3.exe	83
PID 3944 wrote to memory of 4164	3944	0c595ae8175b3eca651908cfdcaab87af3521bf1952e9ac90978b99cd1dd80b3.exe	83

C:\Users\Admin\AppData\Local\Temp\0c595ae8175b3eca651908cfdcaab87af3521bf1952e9ac90978b99cd1dd80b3.exe
"C:\Users\Admin\AppData\Local\Temp\0c595ae8175b3eca651908cfdcaab87af3521bf1952e9ac90978b99cd1dd80b3.exe"
1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 6084
    3⤵
    - Program crash
    PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4164 -ip 4164
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Defender\gahyqah.com

Filesize
24KB

MD5
8d47f3ee9236e8a0d6e91834748e5201

SHA1
1ab7f37396351b0ec622596872879227f54f7c79

SHA256
a2ae31c0e98f3398b5904397cd423eca31fdd6e1e96766152269711b574bad2e

SHA512
459d80266214ddb4eb56fca20a0337b5bd11a383374a39370b2be765a04c9534d8754223083df7ce80b2e605e5c540d05502925b949650e26bf055eaeef9b38e

Download Submit
C:\Program Files (x86)\Windows Defender\galyqaz.com

Filesize
42KB

MD5
dc716c45423231d81f4399d9e1960397

SHA1
7fae801a47b341c137a202be0677d941fd0c3730

SHA256
70d5ea9219470026241b7255a7cc52b8f1c581024953baf350bfe4833fb79955

SHA512
2519e3937e3f5392db8cdbf1e9176185744a2034c09fa59e41e155f0a9c2eb5e40e9271262cfe2feaba6ffe86463124fd76c6e3564bd64b866a9cbc8e123e0c7

Download Submit
C:\Program Files (x86)\Windows Defender\puzylyp.com

Filesize
61KB

MD5
56bb16fe6550890b0d18a7640745bd1e

SHA1
2e91708623d5ef3688a90de0a5cb5964de38a211

SHA256
77b515066548be87dd3e3160bbf2cfbe64f53c8e47313e8d41f1c8adec3fd942

SHA512
48f16899a57aaa3a73801ce4ae4e7f2041a13fa351de18aef67e15f0f2e7b007dbc9dec01898881fe730fc1437c324a7566e72c28bcbf509d321418b31741a15

Download Submit
C:\Program Files (x86)\Windows Defender\qetyhyg.com

Filesize
593B

MD5
926512864979bc27cf187f1de3f57aff

SHA1
acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

SHA256
b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

SHA512
f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

Download Submit
C:\Program Files (x86)\Windows Defender\qexyhuv.com

Filesize
114B

MD5
bfde1e9e9c32c1681a16139450c6909d

SHA1
7e669b927e6a75a10a0ca29e38e58ddcb49b725e

SHA256
e0d020ba1cb6506cee234903a44c747ee0cfa7e2d1e60029e4cd8de9a431512a

SHA512
781fd54f155442dd34f9919b3cd063ee399db411bbfe15f2bdc43d3ab8ac2d04e1011b2c99fab42bebf7b903a94e09aaaef71b7a465d2d04b417f6dad8e8e396

Download Submit
C:\Program Files (x86)\Windows Defender\vojyqem.com

Filesize
1KB

MD5
496800c438316d0f6bb67b5e6bf8d474

SHA1
c096c110bd39df03fba66cf480c92420b3231e52

SHA256
1bb443c84d7c5c64f209fa75f4d21fec8d75d6b7729e355a361ed4af69cc4a21

SHA512
e81542c61dcc6acaca20f3a9382dab8d4315fe772a4f1e3fe36be24fa4b1c6bfa3dcf37df8fec775d8f92732879115ccfe978878454a22ba74c1641bd472a20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G94T3PNL\login[3].htm

Filesize
168B

MD5
d57e3a550060f85d44a175139ea23021

SHA1
2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

SHA256
43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

SHA512
0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

Download Submit
C:\Windows\apppatch\svchost.exe

Filesize
205KB

MD5
86b5c6094a9c966bcb21418ba553c1e5

SHA1
842b4dcab8d4595c2488ca6d37fc9d416f82d9bb

SHA256
70101df42b235fd74bca4965c6464d05f7dba22cb0c4d1b55e903c39d03d3a10

SHA512
d4653f2b6e909e8208b8f1aee4a10116b9df2a58a2bb40208219c9dd6049f96262503d9c3d7e47a3df1ef035b4f6630249440df2d070743389c3384f203d2b78

Download Submit
memory/3944-0-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3944-13-0x0000000002220000-0x000000000226F000-memory.dmp

Filesize
316KB

Download
memory/3944-14-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3944-11-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3944-2-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3944-1-0x0000000002220000-0x000000000226F000-memory.dmp

Filesize
316KB

Download
memory/4164-57-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-48-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-61-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-68-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-79-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-78-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-77-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-75-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-74-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-73-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-72-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-71-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-70-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-69-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-67-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-66-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-65-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-64-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-63-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-62-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-58-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-60-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-59-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-24-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-56-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-54-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-53-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-52-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-51-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-50-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-49-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-23-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-46-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-44-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-43-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-42-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-41-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-40-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-39-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-38-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-37-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-36-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-34-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-33-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-31-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-30-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-29-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-28-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-76-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-55-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-47-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-45-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-35-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-32-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-27-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-26-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-25-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-20-0x0000000002C40000-0x0000000002CF2000-memory.dmp

Filesize
712KB

Download
memory/4164-19-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4164-18-0x0000000002A90000-0x0000000002B34000-memory.dmp

Filesize
656KB

Download
memory/4164-17-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4164-16-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4164-15-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download