Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

78e1bc24f7...eb.exe

windows7-x64

10

78e1bc24f7...eb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/12/2024, 00:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    78e1bc24f7ff36e59201739453289d2ada4ea7bbf5571fb15d815f37a122e5eb.exe

  • Size

    355KB

  • MD5

    712b0d0c30cf2f39b08c42fb954748a4

  • SHA1

    fbcc4afcbaa790bbcb8861791feec2b4be6aedb2

  • SHA256

    78e1bc24f7ff36e59201739453289d2ada4ea7bbf5571fb15d815f37a122e5eb

  • SHA512

    616b254b0b83fbb6d4b9b4b1902f78aeb153d8a4bcfd607c134c767da727166086234b40396a90f2f367d1e16993f28256ea367197559e0bc37182c693cd2cf0

  • SSDEEP

    6144:X3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:kmWhND9yJz+b1FcMLmp2ATTSsdS

Score
10/10
simdadiscoverypersistencestealertrojan

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Simda family
    simda
  • simda

    Simda is an infostealer written in C++.

    stealertrojansimda
  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78e1bc24f7ff36e59201739453289d2ada4ea7bbf5571fb15d815f37a122e5eb.exe
    "C:\Users\Admin\AppData\Local\Temp\78e1bc24f7ff36e59201739453289d2ada4ea7bbf5571fb15d815f37a122e5eb.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3604
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4648

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8B3ZU6S9\login[1].htm
    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGDWJGSY\login[1].htm
    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\92D5.tmp
    Filesize

    12KB

    MD5

    e1f035b24ce0e8137682b703d19315b5

    SHA1

    18712fd6ad888c146237d187332ccc904ff1f032

    SHA256

    117ea4f0f411e1aaeab307c087a57678abcba7e6aa96a5bd1f2d5d7026d453a0

    SHA512

    17a428fcea9d064e8318f0ef30da88c713209f5d591d2a4e9725d56663acdb96996569693804071aea17ddc793eade219409c4548e48d1ddc8814662236bae7d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\92D5.tmp
    Filesize

    12KB

    MD5

    caa300673c11a7627a7b6346e1a93b61

    SHA1

    7ecaf36f1e150c478b6cfc3446ec7f0c662c071a

    SHA256

    42ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa

    SHA512

    f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AD16.tmp
    Filesize

    593B

    MD5

    3b03d93d3487806337b5c6443ce7a62d

    SHA1

    93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

    SHA256

    7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

    SHA512

    770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\AD16.tmp
    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\B901.tmp
    Filesize

    1KB

    MD5

    ea4402adcf353b0c7c7c1532d964fd8e

    SHA1

    91a7a73af4067a3b891d6fe67292775d82141c1f

    SHA256

    ef2f083ccd6ee3a3746e2847dcccdeaf7123ecb7068a2f36d3884ac2f4b68bae

    SHA512

    cc40ee3eebfed114511526976992ddde39d5e9a286a0c89e9124840059363024f283391743081c4f612e37568e54fa35ad2c3553fe3e033347a3b06ace9aa110

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\BBF3.tmp
    Filesize

    61KB

    MD5

    7c2cce06407517910ae70a42a81435fd

    SHA1

    39080500e16cc13d4600e71edf27595e656d2d4a

    SHA256

    e866e20c55554649f1cfc414b799003133a21d0c94ee36a6edb1a491948f66b6

    SHA512

    2c94a5fd5ee3de0cb56510a0dc15042b7d8bda23cb77ecb6e34fb38d469deb6506ad6e71fa111ffc3f1a29eb0b9a0e9b0d206cd2b8b7d5b9d7ac98d8b75e6af1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\BC24.tmp
    Filesize

    42KB

    MD5

    52c9804cd1f2ce08a1c72246f9573af9

    SHA1

    5d10c9c38d5b7780c5d167d26be1458fb9e63339

    SHA256

    b90c25c6d26b91d61157fbebe16cf399a89a19271ba710870225e65577460b79

    SHA512

    6088e7d63fad25409ee6f90ace5870ac415b8afb73790b2989ace255d9bdc33c21bf39d1bf5f979f7b58ebd571975b57658b3c2f2aec1cb4e622288f669734cb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\BC24.tmp
    Filesize

    42KB

    MD5

    0e87cfc8ae3dfb64c60d26d96ec89aa8

    SHA1

    8408eb96c67dae2deb29a1092a58fcd40a4da17d

    SHA256

    750e8392e661f8cd241520f98b3849cb5845c9aabf6ba9207047457442a58386

    SHA512

    8b7bf0c29be46b675da8bef2d5be17c282fc51a6291a9d5cef96e3f81cd418b105364f2fd8432798649e2c6b47d31a60f696ef70986bffdf98b62fc0bb4468fd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\DC86.tmp
    Filesize

    61KB

    MD5

    527be27c3044154035b6f9d60bb83af1

    SHA1

    605b1643ea3e1ad43e081dc638cb523750abfa11

    SHA256

    66ad5f35fbb4c4868c003709376b7f36349d415d914e7f7fbb43345144c4fc28

    SHA512

    e0753a961e7f14dd0d474408eca65bf83aa465856c0e1c33441a5f33dc443f27a433240bcc3282bb16609e209bbec85da8b5b68200f0842471fac85ab58e4993

    Download Submit

  • C:\Windows\apppatch\svchost.exe
    Filesize

    355KB

    MD5

    b07ccdb737db7a4d3813374879e5c41c

    SHA1

    e2138197f5aca4f75195bc0faa4f9bd0020ccdfa

    SHA256

    60c3c6f2587032a5d6b2cece8563d2fe30c81d4cfec7630195ae7a26d9789ae4

    SHA512

    c8649db95bb5349426e09e4be6ab01e27ae66bfb211ee43ff9f07df38a677dd08d2b3c3dcd6f589ada156b01e8e3be540b1dafc174301c4ccd5cffac72381b78

    Download Submit

  • memory/3604-8-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

    Download

  • memory/4648-44-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-36-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-71-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-70-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-69-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-68-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-67-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-66-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-65-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-64-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-63-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-73-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-52-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-51-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-50-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-49-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-48-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-47-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-43-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-41-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-42-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-40-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-39-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-38-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-37-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-53-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-35-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-34-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-33-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-32-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-31-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-29-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-27-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-25-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-23-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-22-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-20-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-19-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-18-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-30-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-26-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-24-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-14-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-16-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-13-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-10-0x0000000002720000-0x00000000027C8000-memory.dmp

    Filesize

    672KB

    Download

  • memory/4648-28-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-21-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-17-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4648-170-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

    Download