Analysis
-
max time kernel
1193s -
max time network
1150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2024 16:27
Behavioral task
behavioral1
Sample
Stix_0_Delay_Utility.exe
Resource
win10v2004-20241007-en
General
-
Target
Stix_0_Delay_Utility.exe
-
Size
1.1MB
-
MD5
50c9b94b577071cb68e2c2d3d37e5d88
-
SHA1
682da2c903e1d00955fd233e7df627832af5feb1
-
SHA256
e370849ba5b1e66d2dc46b4dabd846676089a9bec040e750fadf095b7ec4d222
-
SHA512
66ea317daa6daafa406ddb4e0db861839c284435284369362368a5484dbd5dc988d34e0772e5a822549bbcacd3ff6e340a465b9043f50bf6ccde518f3fdcf8d7
-
SSDEEP
24576:pnsJ39LyjbJkQFMhmC+6GD9+oxobd6YvdRFC:pnsHyjtk2MYC5GDQoi6crFC
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Stix_0_Delay_Utility.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 2864 ._cache_Stix_0_Delay_Utility.exe 2552 Synaptics.exe 4300 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" Stix_0_Delay_Utility.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Stix_0_Delay_Utility.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Stix_0_Delay_Utility.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Stix_0_Delay_Utility.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2864 ._cache_Stix_0_Delay_Utility.exe Token: SeDebugPrivilege 4300 ._cache_Synaptics.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2864 1852 Stix_0_Delay_Utility.exe 86 PID 1852 wrote to memory of 2864 1852 Stix_0_Delay_Utility.exe 86 PID 1852 wrote to memory of 2864 1852 Stix_0_Delay_Utility.exe 86 PID 1852 wrote to memory of 2552 1852 Stix_0_Delay_Utility.exe 88 PID 1852 wrote to memory of 2552 1852 Stix_0_Delay_Utility.exe 88 PID 1852 wrote to memory of 2552 1852 Stix_0_Delay_Utility.exe 88 PID 2552 wrote to memory of 4300 2552 Synaptics.exe 90 PID 2552 wrote to memory of 4300 2552 Synaptics.exe 90 PID 2552 wrote to memory of 4300 2552 Synaptics.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stix_0_Delay_Utility.exe"C:\Users\Admin\AppData\Local\Temp\Stix_0_Delay_Utility.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\._cache_Stix_0_Delay_Utility.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Stix_0_Delay_Utility.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD550c9b94b577071cb68e2c2d3d37e5d88
SHA1682da2c903e1d00955fd233e7df627832af5feb1
SHA256e370849ba5b1e66d2dc46b4dabd846676089a9bec040e750fadf095b7ec4d222
SHA51266ea317daa6daafa406ddb4e0db861839c284435284369362368a5484dbd5dc988d34e0772e5a822549bbcacd3ff6e340a465b9043f50bf6ccde518f3fdcf8d7
-
Filesize
374KB
MD523769f21536777f2b95a2dbd4eecff9a
SHA1f866e354718af010af7e6e38fd0ee900ccfbdf97
SHA2563f9636603264a12fd0103a366241a3dc4dfa4f308f483977e723574dd01fa00e
SHA512d11d834e7e23a4385341bedf5c07f8e4f3cda1bc4adb229056aae3ad30b63f6eb46b19f6b922ee5508db2251a71708d7b721bd01879c0238199adb87cbeaad2d