Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - submitted
29/01/2024, 07:33
General
- Target 43577cb9a20a09790c26676148a9a84299acc0f06666e57bf2ef6667887a2dad.exe
- Size 12.0MB
- Sample240129-jdxdnadaa8
- SHA256 43577cb9a20a09790c26676148a9a84299acc0f06666e57bf2ef6667887a2dad
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Gh0st RAT payload 1 IoCs
- Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Gh0strat family
- Xred
Xred is backdoor written in Delphi.
- Xred family
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 5 IoCs
- VMProtect packed file 9 IoCs
Detects executables packed with VMProtect commercial packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\43577cb9a20a09790c26676148a9a84299acc0f06666e57bf2ef6667887a2dad.exe"C:\Users\Admin\AppData\Local\Temp\43577cb9a20a09790c26676148a9a84299acc0f06666e57bf2ef6667887a2dad.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\HD_43577cb9a20a09790c26676148a9a84299acc0f06666e57bf2ef6667887a2dad.exeC:\Users\Admin\AppData\Local\Temp\HD_43577cb9a20a09790c26676148a9a84299acc0f06666e57bf2ef6667887a2dad.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_HD_43577cb9a20a09790c26676148a9a84299acc0f06666e57bf2ef6667887a2dad.exe"C:\Users\Admin\AppData\Local\Temp\._cache_HD_43577cb9a20a09790c26676148a9a84299acc0f06666e57bf2ef6667887a2dad.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\240598312.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
Synaptics.exe
Synaptics.exe
Synaptics.exe
._cache_HD_43577cb9a20a09790c26676148a9a84299acc0f06666e57bf2ef6667887a2dad.exe
._cache_HD_43577cb9a20a09790c26676148a9a84299acc0f06666e57bf2ef6667887a2dad.exe
._cache_Synaptics.exe
HD_43577cb9a20a09790c26676148a9a84299acc0f06666e57bf2ef6667887a2dad.exe
HD_43577cb9a20a09790c26676148a9a84299acc0f06666e57bf2ef6667887a2dad.exe
YXv8lNca.xlsm
look2.exe
TestMount.exe
240598312.bat
svchcst.exe
memory/1620-18-0x0000000002D90000-0x0000000002D91000-memory.dmp
memory/1620-149-0x0000000000400000-0x0000000000EE5000-memory.dmp
memory/2564-283-0x00007FFF26770000-0x00007FFF26780000-memory.dmp
memory/2564-291-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-281-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-269-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp
memory/2564-276-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp
memory/2564-274-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp
memory/2564-316-0x00007FFF67720000-0x00007FFF677ED000-memory.dmp
memory/2564-277-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-278-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-280-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-282-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-286-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-287-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-292-0x00007FFF67720000-0x00007FFF677ED000-memory.dmp
memory/2564-289-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-315-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-290-0x00007FFF26770000-0x00007FFF26780000-memory.dmp
memory/2564-288-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-284-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-279-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-285-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-275-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-273-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-270-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp
memory/2564-271-0x00007FFF68950000-0x00007FFF68B45000-memory.dmp
memory/2564-272-0x00007FFF289D0000-0x00007FFF289E0000-memory.dmp
memory/4040-268-0x0000000000400000-0x0000000000EE5000-memory.dmp
memory/4040-150-0x0000000000F70000-0x0000000000F71000-memory.dmp
memory/4040-343-0x0000000000400000-0x0000000000EE5000-memory.dmp
memory/4040-310-0x0000000000400000-0x0000000000EE5000-memory.dmp
memory/4276-263-0x0000000010000000-0x0000000010059000-memory.dmp
memory/4276-245-0x0000000001BE0000-0x0000000001BE1000-memory.dmp
memory/4276-256-0x0000000003880000-0x0000000003881000-memory.dmp
memory/4276-309-0x0000000000400000-0x0000000001ABE000-memory.dmp
memory/4276-262-0x0000000003990000-0x00000000039B0000-memory.dmp
memory/4276-254-0x0000000003870000-0x0000000003871000-memory.dmp
memory/4276-253-0x0000000003860000-0x0000000003861000-memory.dmp
memory/4276-250-0x0000000003850000-0x0000000003851000-memory.dmp
memory/4276-251-0x0000000000400000-0x0000000001ABE000-memory.dmp
memory/4276-246-0x0000000001D20000-0x0000000001D21000-memory.dmp
memory/4276-249-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4528-237-0x0000000000400000-0x0000000001ABE000-memory.dmp
memory/4528-307-0x0000000000400000-0x0000000001ABE000-memory.dmp
memory/4528-257-0x00000000039D0000-0x00000000039F0000-memory.dmp
memory/4528-241-0x0000000003880000-0x0000000003881000-memory.dmp
memory/4528-243-0x0000000003890000-0x0000000003891000-memory.dmp
memory/4528-242-0x0000000000400000-0x0000000001ABE000-memory.dmp
memory/4528-240-0x0000000003870000-0x0000000003871000-memory.dmp
memory/4528-234-0x0000000001F30000-0x0000000001F31000-memory.dmp
memory/4528-308-0x0000000000400000-0x0000000001ABE000-memory.dmp
memory/4528-259-0x0000000010000000-0x0000000010059000-memory.dmp
memory/4528-239-0x0000000003860000-0x0000000003861000-memory.dmp
memory/4528-238-0x0000000003850000-0x0000000003851000-memory.dmp
memory/4528-236-0x0000000003810000-0x0000000003811000-memory.dmp
memory/4528-235-0x0000000003800000-0x0000000003801000-memory.dmp