Overview

overview

10

Static

static

1

50f40e9e46...8N.exe

windows7-x64

10

50f40e9e46...8N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    23-01-2025 06:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    50f40e9e46bbc23e49f9a1ff1e6bbb8478e5183ea09f7746f7bfe2e8d4af2138N.exe

  • Size

    201KB

  • MD5

    d163f367385d9ea6fb6b1d91b3f31ae0

  • SHA1

    3757cd93864d66256eb232ec8877677a51be5152

  • SHA256

    50f40e9e46bbc23e49f9a1ff1e6bbb8478e5183ea09f7746f7bfe2e8d4af2138

  • SHA512

    4a2a8c27fe1fda94faa4be9446e43a2e66f757bafd30d0551a73d88b895885f826c7a8615267d74ccfdabe7b86101cda5fd3efcc6eb9741105d34b662947fbf5

  • SSDEEP

    6144:ut++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:Z+cff22qZhZcKYhc/

Score
10/10
simdadiscoverypersistencestealertrojan

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Simda family
    simda
  • simda

    Simda is an infostealer written in C++.

    stealertrojansimda
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 34 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\50f40e9e46bbc23e49f9a1ff1e6bbb8478e5183ea09f7746f7bfe2e8d4af2138N.exe
    "C:\Users\Admin\AppData\Local\Temp\50f40e9e46bbc23e49f9a1ff1e6bbb8478e5183ea09f7746f7bfe2e8d4af2138N.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Windows Defender\gahyqah.com
    Filesize

    24KB

    MD5

    9deb4354c2ea18ad089f10df5326bae0

    SHA1

    c68b17eab622e1bed0d8d2b12d38b651fa0c7caa

    SHA256

    f0c379486046bb9cdc975e45c3aef8789177cad9577b1b578ee39477a559b982

    SHA512

    f004e98dd5c078a75f511306d43c6442f525a600cdfc383f3236cfa0d4820aabec15f46fa79b9dd44a44646f02da125eabba7bfd2448dfaaa46a78144391bf6d

    Download Submit

  • C:\Program Files (x86)\Windows Defender\galynuh.com
    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

    Download Submit

  • C:\Program Files (x86)\Windows Defender\galyqaz.com
    Filesize

    42KB

    MD5

    0b7c50455e7efa0f388a15ea428c808b

    SHA1

    31d412a160eceea64b73de5a8c5edc26a7af9d1b

    SHA256

    bf81a53771b27218dfea7fc84da460fb1f7d4bba82e8fcbd143cbb1c4fe94cf8

    SHA512

    990c412363e3fa88657f5c9ea2a68a6c2d132aaeaecb3c8bf92f458b37c26d16cfe65bade993ed9420cbab238d36c4e8ba3f2352154826a6fe7c346b4793bbf1

    Download Submit

  • C:\Program Files (x86)\Windows Defender\lyxynyx.com
    Filesize

    12KB

    MD5

    caa300673c11a7627a7b6346e1a93b61

    SHA1

    7ecaf36f1e150c478b6cfc3446ec7f0c662c071a

    SHA256

    42ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa

    SHA512

    f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6

    Download Submit

  • C:\Windows\AppPatch\svchost.exe
    Filesize

    201KB

    MD5

    f136135323729f4412a70928d2e82308

    SHA1

    2292c0d64c062988c837b081f75ae2edfd70d745

    SHA256

    6304a2b7e34f664dab9fc796b9dfab6e6aaa463fe00563ecdfdaba5c3cabd57e

    SHA512

    7bf1d3bed1b05b3d444c445909304e2746997b1c9c40c99acd4cf0f85c658dd263ce786db839e5eb717235f9c3d4684d016d48dc751c18b8d90a0f7ddb010da5

    Download Submit

  • memory/2312-1-0x0000000000220000-0x000000000026F000-memory.dmp

    Filesize

    316KB

    Download

  • memory/2312-0-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

    Download

  • memory/2312-2-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

    Download

  • memory/2312-16-0x0000000000220000-0x000000000026F000-memory.dmp

    Filesize

    316KB

    Download

  • memory/2312-18-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

    Download

  • memory/2312-15-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

    Download

  • memory/2764-75-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-69-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-21-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

    Download

  • memory/2764-24-0x0000000001F50000-0x0000000001FF4000-memory.dmp

    Filesize

    656KB

    Download

  • memory/2764-32-0x0000000001F50000-0x0000000001FF4000-memory.dmp

    Filesize

    656KB

    Download

  • memory/2764-30-0x0000000001F50000-0x0000000001FF4000-memory.dmp

    Filesize

    656KB

    Download

  • memory/2764-33-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

    Download

  • memory/2764-26-0x0000000001F50000-0x0000000001FF4000-memory.dmp

    Filesize

    656KB

    Download

  • memory/2764-28-0x0000000001F50000-0x0000000001FF4000-memory.dmp

    Filesize

    656KB

    Download

  • memory/2764-22-0x0000000001F50000-0x0000000001FF4000-memory.dmp

    Filesize

    656KB

    Download

  • memory/2764-34-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-38-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-36-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-45-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-46-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-84-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-83-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-82-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-81-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-79-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-78-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-77-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-76-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-19-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

    Download

  • memory/2764-74-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-73-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-72-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-71-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-70-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-20-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

    Download

  • memory/2764-68-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-67-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-66-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-65-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-64-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-63-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-61-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-60-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-59-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-58-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-57-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-56-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-55-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-54-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-53-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-52-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-51-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-50-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-49-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-48-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-47-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-80-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-44-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-43-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-42-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-62-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-41-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2764-40-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

    Download