Analysis

  • max time kernel
    106s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-05-2022 16:23

General

  • Target

    exploror.exe

  • Size

    1.1MB

  • MD5

    d6df53506b123f5717463d0355336979

  • SHA1

    7720fb4b89a4ebcef32a6d6a9a7a88c65cad2c14

  • SHA256

    70969f1d56ec1ddcae3fc50545c0a351b798226c62d870db8ae5170eeec67694

  • SHA512

    1bfefa221ed77ef05fc72fbc20a322cae990b2a33a9af47b9ee4d9fa1c09d5c81f6a8fd8496ed43a47ee2862e1e2bf1651b4cca2f5e9e23e491c3d4b3249ad2f

Malware Config

Signatures

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

  • Chinese Botnet Payload 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 49 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\exploror.exe
    "C:\Users\Admin\AppData\Local\Temp\exploror.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Users\Admin\AppData\Local\Temp\._cache_exploror.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_exploror.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2040
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      PID:2000
  • C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe
    "C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:516
    • C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe
      "C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe" Win7
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      PID:1308

Network

  • flag-us
    DNS
    xred.mooo.com
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    xred.mooo.com
    IN A
    Response
  • flag-us
    DNS
    freedns.afraid.org
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    freedns.afraid.org
    IN A
    Response
    freedns.afraid.org
    IN A
    69.42.215.252
  • flag-us
    GET
    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
    Synaptics.exe
    Remote address:
    69.42.215.252:80
    Request
    GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1
    User-Agent: MyApp
    Host: freedns.afraid.org
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 12 May 2022 16:29:26 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Vary: Accept-Encoding
    X-Cache: MISS
  • flag-us
    DNS
    docs.google.com
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    docs.google.com
    IN A
    Response
    docs.google.com
    IN A
    142.250.179.174
  • flag-nl
    GET
    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    142.250.179.174:443
    Request
    GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Host: docs.google.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/html; charset=utf-8
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Thu, 12 May 2022 16:30:25 GMT
    Strict-Transport-Security: max-age=31536000
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Cross-Origin-Opener-Policy: same-origin
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Content-Security-Policy: script-src 'report-sample' 'nonce-CYML6XF0LBjCtCWAQrw9Cw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Server: ESF
    X-XSS-Protection: 0
    X-Content-Type-Options: nosniff
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
    Accept-Ranges: none
    Vary: Accept-Encoding
    Transfer-Encoding: chunked
  • flag-nl
    GET
    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    142.250.179.174:443
    Request
    GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Host: docs.google.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/html; charset=utf-8
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Thu, 12 May 2022 16:30:25 GMT
    Strict-Transport-Security: max-age=31536000
    Content-Security-Policy: script-src 'report-sample' 'nonce-w7n//As0/wpHrqsE1Q9zhA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
    Cross-Origin-Opener-Policy: same-origin
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Server: ESF
    X-XSS-Protection: 0
    X-Content-Type-Options: nosniff
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
    Accept-Ranges: none
    Vary: Accept-Encoding
    Transfer-Encoding: chunked
  • flag-nl
    GET
    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    142.250.179.174:443
    Request
    GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Host: docs.google.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/html; charset=utf-8
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Thu, 12 May 2022 16:30:25 GMT
    Strict-Transport-Security: max-age=31536000
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Cross-Origin-Opener-Policy: same-origin
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Content-Security-Policy: script-src 'report-sample' 'nonce-JiS5RbkrB1fzLRJ0gOpVdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Server: ESF
    X-XSS-Protection: 0
    X-Content-Type-Options: nosniff
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
    Accept-Ranges: none
    Vary: Accept-Encoding
    Transfer-Encoding: chunked
  • 106.52.15.123:80
    ._cache_exploror.exe
    152 B
    80 B
    3
    2
  • 69.42.215.252:80
    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
    http
    Synaptics.exe
    706 B
    415 B
    12
    4

    HTTP Request

    GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    HTTP Response

    200
  • 106.52.15.123:80
    ._cache_exploror.exe
    152 B
    120 B
    3
    3
  • 106.52.15.123:80
    Peahrfb.exe
    152 B
    120 B
    3
    3
  • 106.52.15.123:80
    Peahrfb.exe
    152 B
    80 B
    3
    2
  • 106.52.15.123:80
    Peahrfb.exe
    152 B
    40 B
    3
    1
  • 47.93.60.63:80
    http
    ._cache_exploror.exe
    1.0kB
    338 B
    9
    8
  • 106.52.15.123:80
    Peahrfb.exe
    152 B
    120 B
    3
    3
  • 142.250.179.174:443
    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    tls, http
    Synaptics.exe
    1.6kB
    18.0kB
    17
    25

    HTTP Request

    GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    404

    HTTP Request

    GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    404

    HTTP Request

    GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    404
  • 8.8.8.8:53
    xred.mooo.com
    dns
    Synaptics.exe
    59 B
    118 B
    1
    1

    DNS Request

    xred.mooo.com

  • 8.8.8.8:53
    freedns.afraid.org
    dns
    Synaptics.exe
    64 B
    80 B
    1
    1

    DNS Request

    freedns.afraid.org

    DNS Response

    69.42.215.252

  • 8.8.8.8:53
    docs.google.com
    dns
    Synaptics.exe
    61 B
    77 B
    1
    1

    DNS Request

    docs.google.com

    DNS Response

    142.250.179.174

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe

    Filesize

    400KB

    MD5

    f82f50d6a61d3d73172fcbf3ff665e89

    SHA1

    2e5cde938a2822a13348e55f4ad0dfa75d545fee

    SHA256

    afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd

    SHA512

    f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb

  • C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe

    Filesize

    400KB

    MD5

    f82f50d6a61d3d73172fcbf3ff665e89

    SHA1

    2e5cde938a2822a13348e55f4ad0dfa75d545fee

    SHA256

    afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd

    SHA512

    f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb

  • C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe

    Filesize

    400KB

    MD5

    f82f50d6a61d3d73172fcbf3ff665e89

    SHA1

    2e5cde938a2822a13348e55f4ad0dfa75d545fee

    SHA256

    afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd

    SHA512

    f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    754KB

    MD5

    310a7ff41f6633132e6c2bc25e51e567

    SHA1

    5f687df8cc3185ed68d77d0e05502c2eb308c5c8

    SHA256

    d1425edf482717cb64db2a36357866045b0c6306d919296591ffc9bc45d680ab

    SHA512

    ee9b3114cb37e52793bccdf20a27158f5def67ed9c7d8eb772e1deaf5d5f9a0030e847dea40bb320637f29508f1be2a49c3095460a6fd3afbc3bca196f642980

  • C:\Users\Admin\AppData\Local\Temp\._cache_exploror.exe

    Filesize

    400KB

    MD5

    f82f50d6a61d3d73172fcbf3ff665e89

    SHA1

    2e5cde938a2822a13348e55f4ad0dfa75d545fee

    SHA256

    afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd

    SHA512

    f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb

  • C:\Users\Admin\AppData\Local\Temp\._cache_exploror.exe

    Filesize

    400KB

    MD5

    f82f50d6a61d3d73172fcbf3ff665e89

    SHA1

    2e5cde938a2822a13348e55f4ad0dfa75d545fee

    SHA256

    afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd

    SHA512

    f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb

  • \ProgramData\Synaptics\Synaptics.exe

    Filesize

    754KB

    MD5

    310a7ff41f6633132e6c2bc25e51e567

    SHA1

    5f687df8cc3185ed68d77d0e05502c2eb308c5c8

    SHA256

    d1425edf482717cb64db2a36357866045b0c6306d919296591ffc9bc45d680ab

    SHA512

    ee9b3114cb37e52793bccdf20a27158f5def67ed9c7d8eb772e1deaf5d5f9a0030e847dea40bb320637f29508f1be2a49c3095460a6fd3afbc3bca196f642980

  • \ProgramData\Synaptics\Synaptics.exe

    Filesize

    754KB

    MD5

    310a7ff41f6633132e6c2bc25e51e567

    SHA1

    5f687df8cc3185ed68d77d0e05502c2eb308c5c8

    SHA256

    d1425edf482717cb64db2a36357866045b0c6306d919296591ffc9bc45d680ab

    SHA512

    ee9b3114cb37e52793bccdf20a27158f5def67ed9c7d8eb772e1deaf5d5f9a0030e847dea40bb320637f29508f1be2a49c3095460a6fd3afbc3bca196f642980

  • \Users\Admin\AppData\Local\Temp\._cache_exploror.exe

    Filesize

    400KB

    MD5

    f82f50d6a61d3d73172fcbf3ff665e89

    SHA1

    2e5cde938a2822a13348e55f4ad0dfa75d545fee

    SHA256

    afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd

    SHA512

    f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb

  • \Users\Admin\AppData\Local\Temp\._cache_exploror.exe

    Filesize

    400KB

    MD5

    f82f50d6a61d3d73172fcbf3ff665e89

    SHA1

    2e5cde938a2822a13348e55f4ad0dfa75d545fee

    SHA256

    afbf8e478edc3d239953a3653a5ec113363fb9406552536d6469581b52585bcd

    SHA512

    f5945f9c5b4cfcd29498b24ec43000e6ec2927ec264d758aeeb4325f4c5f2b1d03fb997c84b38daec82b4a1dbc9f049b932ca399ef02778072cf594b1b5044fb

  • memory/756-54-0x00000000755B1000-0x00000000755B3000-memory.dmp

    Filesize

    8KB

  • memory/2040-65-0x0000000010000000-0x0000000010018000-memory.dmp

    Filesize

    96KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.