Overview

overview

10

Static

static

1

ecf38e67e8...47.exe

windows7-x64

10

ecf38e67e8...47.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    113s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-01-2025 11:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ecf38e67e85a8345732ba8ab9c3616dcf82e6f19590480641359f5d94e403a47.exe

  • Size

    218KB

  • MD5

    4bd6a0678d6c9d5d2b1233479830bb5d

  • SHA1

    82c5441cd8c37b9d0ccf1446d1caa6db1adcebc8

  • SHA256

    ecf38e67e85a8345732ba8ab9c3616dcf82e6f19590480641359f5d94e403a47

  • SHA512

    bcd64c022176bb7bfe8fabc110dbd918bc4c20045882bc7932abba609b9e430dfd736c160759b2f3773455d60f4c78bdc2b5ea99558474768edd2864b04d5feb

  • SSDEEP

    3072:ovm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Ha:m1SyAJp6rjn1gOObn4b6h9R

Score
10/10
simdadiscoverypersistencestealertrojan

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Simda family
    simda
  • simda

    Simda is an infostealer written in C++.

    stealertrojansimda
  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecf38e67e85a8345732ba8ab9c3616dcf82e6f19590480641359f5d94e403a47.exe
    "C:\Users\Admin\AppData\Local\Temp\ecf38e67e85a8345732ba8ab9c3616dcf82e6f19590480641359f5d94e403a47.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\321WJBEQ\login[2].htm
    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\203B.tmp
    Filesize

    12KB

    MD5

    e1f035b24ce0e8137682b703d19315b5

    SHA1

    18712fd6ad888c146237d187332ccc904ff1f032

    SHA256

    117ea4f0f411e1aaeab307c087a57678abcba7e6aa96a5bd1f2d5d7026d453a0

    SHA512

    17a428fcea9d064e8318f0ef30da88c713209f5d591d2a4e9725d56663acdb96996569693804071aea17ddc793eade219409c4548e48d1ddc8814662236bae7d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\203B.tmp
    Filesize

    12KB

    MD5

    caa300673c11a7627a7b6346e1a93b61

    SHA1

    7ecaf36f1e150c478b6cfc3446ec7f0c662c071a

    SHA256

    42ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa

    SHA512

    f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3002.tmp
    Filesize

    61KB

    MD5

    a34fc007a15e1dcd06d85c6efaaca294

    SHA1

    b35eddeaffcb6eb58df27e460c1cd23e92e73c59

    SHA256

    9be43586c462c9dc23b1ab6ecd6c3d57b590d6db64a92d097d5da85293a0626c

    SHA512

    983ffcc22f2c426b16f96c4bfd3461f61274d15e48b40324a580c64fba2dab70ed5c9b1bb4807ae6e2d0b602e171e74bf942dba51020c09c840c1ca24a4fd4c9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\60EC.tmp
    Filesize

    593B

    MD5

    3b03d93d3487806337b5c6443ce7a62d

    SHA1

    93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

    SHA256

    7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

    SHA512

    770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\60EC.tmp
    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\6F6B.tmp
    Filesize

    61KB

    MD5

    d8d4e1e455fa763d9d3f7fd8c3cb99c3

    SHA1

    de3ace5255e4662911292c3249a6be434c02c27d

    SHA256

    1b358604da197fabc24f044729a254a18375c594245f880e4651d161b87a3263

    SHA512

    63ee7354c720eda836f4882dc10beb3b37dfd8352a751277165f8f95c42329443a10133231aa9e139fce9de9d747a37c1c3ff80a9df855c5b3ca8f9c2c31bcf3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\702B.tmp
    Filesize

    42KB

    MD5

    6033e41c9ae711bf8e7932c376a2faba

    SHA1

    2f3ec75e56ca70e4902a3ffd35cecf7d469b9cbe

    SHA256

    cbde4a01b34eab8ffdeecb0a5d9e23c7ac41dbfa5c215b7e2af8919ea872ae3f

    SHA512

    b8bdbbf0277e13254ee552676e001a5599c2f66f4c728cf7d9ea80e261f813d6c2b10b7ffc8425e8260a2be460ba965426280b067387cc0f6326786b68bf5e0f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\702B.tmp
    Filesize

    42KB

    MD5

    ada7af99ec7350db10abb02080d790e1

    SHA1

    db5e9af397988ee22f7455597acea1a591113783

    SHA256

    8613e32311bab6f4b1886c4fbbfa7f8a270414f34939e61a5e1e401f13cbae3b

    SHA512

    473422736d32448cf5292388aac2180677751c20a42904d3f7e5ded1216fcba168b38d8dd1ba09672975ff2c1d75dccba07bb9a2f748b6deee9a33b85772396d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\9418.tmp
    Filesize

    24KB

    MD5

    601e404a11bfd1024146de627118c65c

    SHA1

    38f1e6d2a4e28ecf07c34c40a376f2d498f5e61e

    SHA256

    966d73d2fc11f0db1760b660ae62cba1a042c822db2c94d3f267190fbcf725b9

    SHA512

    2317850a85cef62aad405facc6618fe919b5f4e912a929226ca32d22752f438f39129319234b5b7e49811ed66b24714c3c0aafeb14c6f8704fbf2505640a508c

    Download Submit

  • C:\Windows\apppatch\svchost.exe
    Filesize

    218KB

    MD5

    97f9617b6bf5333f344fe12f1b04420b

    SHA1

    cfdf41d7e7288956063e85e0a7c181befaa6777f

    SHA256

    b6c486ba7e6aa68a54a3b4ed2132177d87e207a1eb04aa4e7efc96d0fda8d487

    SHA512

    0fb662e4e76df6e14837a55cd2e8a8f49e37ebd896177cce6d953a60e431ffb2121a47b0872f7f606d3df78bc0a5b157dbeddeebc21a64be3fbd6770fb872801

    Download Submit

  • memory/1384-0-0x0000000002320000-0x0000000002371000-memory.dmp

    Filesize

    324KB

    Download

  • memory/1384-12-0x0000000002320000-0x0000000002371000-memory.dmp

    Filesize

    324KB

    Download

  • memory/1384-13-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

    Download

  • memory/1384-11-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1384-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

    Download

  • memory/3532-46-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-38-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-79-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-77-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-76-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-74-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-73-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-71-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-70-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-68-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-66-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-65-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-63-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-61-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-62-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-60-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-59-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-57-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-55-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-53-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-52-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-50-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-49-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-47-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-25-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-45-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-44-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-43-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-42-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-41-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-40-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-24-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-37-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-35-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-34-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-33-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-32-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-31-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-30-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-29-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-28-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-27-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-23-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-78-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-75-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-72-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-69-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-67-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-64-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-58-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-56-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-54-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-51-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-48-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-39-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-20-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-22-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-18-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-17-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/3532-16-0x00000000028D0000-0x0000000002978000-memory.dmp

    Filesize

    672KB

    Download

  • memory/3532-15-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/3532-14-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/3532-36-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3532-26-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

    Download