Analysis

  • max time kernel
    114s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2025, 11:39

General

  • Target

    9b20be5bbd33815a0049cadc388dd05f258f2ee872a3f683c1eb9edd854567bfN.exe

  • Size

    218KB

  • MD5

    dcf73d3e53cd8c11458bfcdb05bcddc0

  • SHA1

    a941a8a176a9fa218532c5a357ce5195db8fd253

  • SHA256

    9b20be5bbd33815a0049cadc388dd05f258f2ee872a3f683c1eb9edd854567bf

  • SHA512

    bf02c5bf35aca1d01e653699b9f72dac1b68e1249dacb4a7e60be63c333a4788bff60612ba2daa3dd28b0617fdfe44280bc690ecb788b452fb462f074dad6bab

  • SSDEEP

    3072:Evm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:S1SyAJp6rjn1gOObn4b6h9h

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b20be5bbd33815a0049cadc388dd05f258f2ee872a3f683c1eb9edd854567bfN.exe
    "C:\Users\Admin\AppData\Local\Temp\9b20be5bbd33815a0049cadc388dd05f258f2ee872a3f683c1eb9edd854567bfN.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4656

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8R55UT9S\login[5].htm

          Filesize

          162B

          MD5

          4f8e702cc244ec5d4de32740c0ecbd97

          SHA1

          3adb1f02d5b6054de0046e367c1d687b6cdf7aff

          SHA256

          9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

          SHA512

          21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OIPZWEW8\login[2].htm

          Filesize

          168B

          MD5

          d57e3a550060f85d44a175139ea23021

          SHA1

          2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

          SHA256

          43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

          SHA512

          0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

        • C:\Users\Admin\AppData\Local\Temp\13A8.tmp

          Filesize

          12KB

          MD5

          e1f035b24ce0e8137682b703d19315b5

          SHA1

          18712fd6ad888c146237d187332ccc904ff1f032

          SHA256

          117ea4f0f411e1aaeab307c087a57678abcba7e6aa96a5bd1f2d5d7026d453a0

          SHA512

          17a428fcea9d064e8318f0ef30da88c713209f5d591d2a4e9725d56663acdb96996569693804071aea17ddc793eade219409c4548e48d1ddc8814662236bae7d

        • C:\Users\Admin\AppData\Local\Temp\24A5.tmp

          Filesize

          61KB

          MD5

          11db8502075f0709678baf89a5e49071

          SHA1

          a44f0fcf663a334be1a8a16143eca339205f34f8

          SHA256

          1f2e82b31ac9709ca27760a2f2bdd53ed282f21210b4cb7734846dc638e3ce95

          SHA512

          f7f10c6d68497a771f3be5d6d5cf0d40ce3078081b56efe9ba9fcd6946afa915bebe936323248753a6314cd1f3b8deb34927d6df6d28cc29d615c721fdf3ae30

        • C:\Users\Admin\AppData\Local\Temp\4BCE.tmp

          Filesize

          593B

          MD5

          3b03d93d3487806337b5c6443ce7a62d

          SHA1

          93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

          SHA256

          7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

          SHA512

          770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

        • C:\Users\Admin\AppData\Local\Temp\4BCE.tmp

          Filesize

          593B

          MD5

          926512864979bc27cf187f1de3f57aff

          SHA1

          acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

          SHA256

          b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

          SHA512

          f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

        • C:\Users\Admin\AppData\Local\Temp\60B8.tmp

          Filesize

          61KB

          MD5

          9d6ea78e757a973663dad6895582a5c1

          SHA1

          36103e6f631f917ee5c6f48ed0f4b9b4d90bca7e

          SHA256

          1307898e16bba194791d8c5a1b2d408a6fafadff780aa7fba49209e345d3d693

          SHA512

          9403ca3c4f7ef5b771ce6e120bdca8fa0b183aa2ec6b52d95409989c973b2e5758f48a81f15c52e4643c889d09408702b5e26a2a80b477e361af09ca693143f6

        • C:\Users\Admin\AppData\Local\Temp\60C9.tmp

          Filesize

          42KB

          MD5

          f5607f5482979fc96158f02ce7cf15c4

          SHA1

          0d553dffa51c7dde3ebc55a9e8526f21470f42a9

          SHA256

          164aa498bc6b06f62aa3fb2c00f4060acc64b5fdbab163468dbfccfe6b170e29

          SHA512

          587f5669905b5c1d09c86fcc06c9f3f9c94a778f6375b34ee7e874c1575bc494b555fe247cae85ffa0397c58af36491d898084627764652cd0ed2a15b3e57924

        • C:\Users\Admin\AppData\Local\Temp\60C9.tmp

          Filesize

          42KB

          MD5

          2e3628e828e9cde4dd15e6d3bb78852f

          SHA1

          edb2fddde9f2115ae9868ebfbf4a517614c0d7b8

          SHA256

          d7eb8c0767c288b35919a419a8a1a45e5135c9f538109f6da306a2d2325e43e5

          SHA512

          96b444fd79e688598ee5cca67e8b9882393addca45ae6cbad5de86f631bf658ca5ce9d64f6c9bb1df55cfbb6691f55d0745e6bcd50ce8d441e57a87a73419859

        • C:\Windows\apppatch\svchost.exe

          Filesize

          218KB

          MD5

          1cbe8c749524accff7c7aa809d05184a

          SHA1

          caa9c3fc7369573b54a249450ff6bef13fe5248a

          SHA256

          29106811eada56eafe578729c7842135028422105e5b8ec860065531129e8b21

          SHA512

          d5bf3e26051152477c3f9e5a06d447f04ddc416ff46f84806a0d12de4e05c44ac83494e84382ac0c904edce2710a557c07d5481f2c286382bc2cf79326dbadc8

        • memory/1496-12-0x0000000002300000-0x0000000002351000-memory.dmp

          Filesize

          324KB

        • memory/1496-13-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/1496-11-0x0000000000400000-0x00000000005AE000-memory.dmp

          Filesize

          1.7MB

        • memory/1496-1-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/1496-0-0x0000000002300000-0x0000000002351000-memory.dmp

          Filesize

          324KB

        • memory/4656-57-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-48-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-42-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-79-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-78-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-76-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-75-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-74-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-73-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-72-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-71-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-70-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-69-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-68-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-67-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-66-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-65-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-64-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-63-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-62-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-61-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-60-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-59-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-20-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-56-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-54-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-53-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-52-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-51-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-50-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-49-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-38-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-47-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-46-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-45-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-44-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-43-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-41-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-40-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-39-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-37-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-36-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-35-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-34-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-33-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-32-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-31-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-30-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-29-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-28-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-27-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-77-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-25-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-24-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-58-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-22-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-18-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-17-0x0000000000400000-0x00000000005AE000-memory.dmp

          Filesize

          1.7MB

        • memory/4656-16-0x00000000028D0000-0x0000000002978000-memory.dmp

          Filesize

          672KB

        • memory/4656-15-0x0000000000400000-0x00000000005AE000-memory.dmp

          Filesize

          1.7MB

        • memory/4656-14-0x0000000000400000-0x00000000005AE000-memory.dmp

          Filesize

          1.7MB

        • memory/4656-55-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-23-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB

        • memory/4656-26-0x0000000002D00000-0x0000000002DB6000-memory.dmp

          Filesize

          728KB