Overview

overview

10

Static

static

1

2d181aeff6...a4.exe

windows7-x64

10

2d181aeff6...a4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-01-2025 02:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2d181aeff6134ecf07042de8a5d372e6c7f551a08daa207e842a8287e63b8da4.exe

  • Size

    201KB

  • MD5

    c6dca67f967c6d9bc496fa08552baec2

  • SHA1

    6ec2cf7e84a9e6e160463622406c97da82ad6eda

  • SHA256

    2d181aeff6134ecf07042de8a5d372e6c7f551a08daa207e842a8287e63b8da4

  • SHA512

    71598b6ee4535cd00ba1a81c10a2a40f795eb89fa2461c25b56055e7e9ae688c7987e166abc4cd062a824e8d2cc29fee1d6e1de2c54cd5304d65558f22aac4fa

  • SSDEEP

    6144:ut++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY0:Z+cff22qZhZcKYhc/d

Score
10/10
simdadiscoverypersistencestealertrojan

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Simda family
    simda
  • simda

    Simda is an infostealer written in C++.

    stealertrojansimda
  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 34 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2d181aeff6134ecf07042de8a5d372e6c7f551a08daa207e842a8287e63b8da4.exe
    "C:\Users\Admin\AppData\Local\Temp\2d181aeff6134ecf07042de8a5d372e6c7f551a08daa207e842a8287e63b8da4.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4264

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Windows Defender\galynuh.com
    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

    Download Submit

  • C:\Program Files (x86)\Windows Defender\galyqaz.com
    Filesize

    41KB

    MD5

    98a733d1b1f1caae2476b254302c53b0

    SHA1

    30d8e98b767b794294070e2bf250f7fab3b72936

    SHA256

    599b0360d2a38ec19a07a6027230c50ca2ca480311cc97599c1e1515073e7d9a

    SHA512

    d9564161b4883bc767c38fd3a1591ac3835e3eec12682f25c3e944064505e70aa5597e5396c280f048acc2fe8c8cc9ad69278623b9085304116030e4fba58eb0

    Download Submit

  • C:\Program Files (x86)\Windows Defender\lysyfyj.com
    Filesize

    481B

    MD5

    cb6e498caaf4425d3616cfa8de2cdcae

    SHA1

    db117013a5ebd65d394dadba699417fbf449fa1d

    SHA256

    1dae54299581f2c9af227c9f5cb1097fe74e28cf272244415ea11eb34e6eed72

    SHA512

    81eb2b41302bc034c15c47bda2e688339e412d4d02e8fe1710d2d2b71c68e1037c8f685f80c699e3658d0457d2428174418a6f2d7d27eed42054ca0f7618c90a

    Download Submit

  • C:\Program Files (x86)\Windows Defender\lyxynyx.com
    Filesize

    12KB

    MD5

    caa300673c11a7627a7b6346e1a93b61

    SHA1

    7ecaf36f1e150c478b6cfc3446ec7f0c662c071a

    SHA256

    42ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa

    SHA512

    f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6

    Download Submit

  • C:\Program Files (x86)\Windows Defender\puzylyp.com
    Filesize

    61KB

    MD5

    051215e2c82ea2bde417d943df56b01c

    SHA1

    0d8e8964a94f0fcf01f80af5f6a362e3dc458e48

    SHA256

    adb5196ca327a1dab0540ad9fde609824ea5217802d68fd44cd6d6f15e3d9639

    SHA512

    ebd54f0d15a1b1c89ef56b254df83dd78eb879f05170f5a92d5920260bb4bd3ba1723bd270910c8fc4b5cd7978db43bb83b26e36053ed17b5ed750307b02e4b4

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TRPPE7V2\login[4].htm
    Filesize

    593B

    MD5

    3b03d93d3487806337b5c6443ce7a62d

    SHA1

    93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

    SHA256

    7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

    SHA512

    770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X3JA8BBM\login[2].htm
    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

    Download Submit

  • C:\Windows\apppatch\svchost.exe
    Filesize

    201KB

    MD5

    7ae57f05f7ef936d25a317a08f7aeafa

    SHA1

    2448450205387fc159bce1c75224f5b0b951c486

    SHA256

    905efeb9b630b004492312c94784926451c8733bc85fa45c9de6a81cabb4bc35

    SHA512

    2f6cf6daa7fb2b00c999636d2b73b4b4995fde6084ef8b26bbc7366329abe6ac71356cc3f736ff471d2aed36cd7300a39975bb05002b9bffc4b5610f34ebffab

    Download Submit

  • memory/1448-1-0x0000000002260000-0x00000000022AF000-memory.dmp

    Filesize

    316KB

    Download

  • memory/1448-14-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

    Download

  • memory/1448-12-0x0000000002260000-0x00000000022AF000-memory.dmp

    Filesize

    316KB

    Download

  • memory/1448-11-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

    Download

  • memory/1448-2-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

    Download

  • memory/1448-0-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

    Download

  • memory/4264-60-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-51-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-20-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-24-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-22-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-28-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-34-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-79-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-78-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-77-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-76-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-75-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-74-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-73-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-72-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-71-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-70-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-69-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-67-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-66-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-65-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-63-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-62-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-61-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-18-0x00000000029E0000-0x0000000002A84000-memory.dmp

    Filesize

    656KB

    Download

  • memory/4264-59-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-58-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-56-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-55-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-54-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-52-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-19-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

    Download

  • memory/4264-50-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-49-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-48-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-47-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-46-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-45-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-44-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-43-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-41-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-40-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-39-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-38-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-37-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-36-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-35-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-33-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-32-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-31-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-30-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-29-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-26-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-27-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-68-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-64-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-17-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

    Download

  • memory/4264-16-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

    Download

  • memory/4264-15-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

    Download

  • memory/4264-57-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-53-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-42-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4264-25-0x0000000002BD0000-0x0000000002C82000-memory.dmp

    Filesize

    712KB

    Download