Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 02:20
Behavioral task
behavioral1
Sample
d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe
Resource
win10v2004-20241007-en
General
-
Target
d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe
-
Size
825KB
-
MD5
fab0e0e642273110c6b49d8c89c44f10
-
SHA1
9ab889c59206105590f02f07211ccb45dea20f20
-
SHA256
d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274
-
SHA512
92ddc88b6005da878e80baa9a4b8bc653c2ae7a7a8d5ab1b8753728f3c7389bc627dcbed9f022d109c05a84ba13b408d88a2aa633f976ae6acf304201fc93c9a
-
SSDEEP
12288:xMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9vSlNaK:xnsJ39LyjbJkQFMhmC+6GD9Ox
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 4884 ._cache_d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 312 Synaptics.exe 1384 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3388 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3388 EXCEL.EXE 3388 EXCEL.EXE 3388 EXCEL.EXE 3388 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1840 wrote to memory of 4884 1840 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 86 PID 1840 wrote to memory of 4884 1840 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 86 PID 1840 wrote to memory of 4884 1840 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 86 PID 1840 wrote to memory of 312 1840 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 87 PID 1840 wrote to memory of 312 1840 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 87 PID 1840 wrote to memory of 312 1840 d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe 87 PID 312 wrote to memory of 1384 312 Synaptics.exe 88 PID 312 wrote to memory of 1384 312 Synaptics.exe 88 PID 312 wrote to memory of 1384 312 Synaptics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe"C:\Users\Admin\AppData\Local\Temp\d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\._cache_d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4884
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1384
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
825KB
MD5fab0e0e642273110c6b49d8c89c44f10
SHA19ab889c59206105590f02f07211ccb45dea20f20
SHA256d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274
SHA51292ddc88b6005da878e80baa9a4b8bc653c2ae7a7a8d5ab1b8753728f3c7389bc627dcbed9f022d109c05a84ba13b408d88a2aa633f976ae6acf304201fc93c9a
-
C:\Users\Admin\AppData\Local\Temp\._cache_d6e8f10d93dc26c01de346dcc6608992c31f59da317b484aa5068ebe66d85274N.exe
Filesize71KB
MD5ff7e74f75177cb86a1e6a1fcbab16ce2
SHA17f7a1a24243e236095752e6e62be1ebf6ccca64d
SHA25654eb9d6eee1124ddbd772cd07daf266f69ed341e41eac74d4222d39ca19e9df8
SHA51231ebe9d976ec93b03018b85911b3a97918c11945fa4a2e1e5a93d143cd9d93efeb93966d1a3edbaea740a29297b7a8319d00e91b35e873e8857b5ff2c24bc21c
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04