Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-11-2024 13:04
Behavioral task
behavioral1
Sample
2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe
Resource
win10v2004-20241007-en
General
-
Target
2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe
-
Size
1.7MB
-
MD5
433186db017b2b23e8dab25763de3240
-
SHA1
80f659c3a32a40310e81754fa403ae9ddb679e0e
-
SHA256
2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42c
-
SHA512
f12bb0b62d0ecae5dd1f4f6b894ad34eed4a26a07343eead5ad49844726c6303fb97f4a8288dd5bdaea3fdb1115878ca9f3f4c3299492845bf624807e62b743d
-
SSDEEP
24576:rnsJ39LyjbJkQFMhmC+6GD9GueLfaO9yaooJn0PfSYvMK4aimr5IsNftaiuv:rnsHyjtk2MYC5GDEjaOIS1475hkv
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
Processes:
._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exeSynaptics.exe._cache_Synaptics.exepid process 2384 ._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe 2204 Synaptics.exe 2860 ._cache_Synaptics.exe -
Loads dropped DLL 7 IoCs
Processes:
2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exeSynaptics.exepid process 2940 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe 2940 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe 2940 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe 2940 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe 2204 Synaptics.exe 2204 Synaptics.exe 2204 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exeSynaptics.exe._cache_Synaptics.exeEXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2612 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
EXCEL.EXEpid process 2612 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exeSynaptics.exedescription pid process target process PID 2940 wrote to memory of 2384 2940 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe ._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe PID 2940 wrote to memory of 2384 2940 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe ._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe PID 2940 wrote to memory of 2384 2940 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe ._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe PID 2940 wrote to memory of 2384 2940 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe ._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe PID 2940 wrote to memory of 2204 2940 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe Synaptics.exe PID 2940 wrote to memory of 2204 2940 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe Synaptics.exe PID 2940 wrote to memory of 2204 2940 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe Synaptics.exe PID 2940 wrote to memory of 2204 2940 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe Synaptics.exe PID 2204 wrote to memory of 2860 2204 Synaptics.exe ._cache_Synaptics.exe PID 2204 wrote to memory of 2860 2204 Synaptics.exe ._cache_Synaptics.exe PID 2204 wrote to memory of 2860 2204 Synaptics.exe ._cache_Synaptics.exe PID 2204 wrote to memory of 2860 2204 Synaptics.exe ._cache_Synaptics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe"C:\Users\Admin\AppData\Local\Temp\2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2384
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5433186db017b2b23e8dab25763de3240
SHA180f659c3a32a40310e81754fa403ae9ddb679e0e
SHA2562b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42c
SHA512f12bb0b62d0ecae5dd1f4f6b894ad34eed4a26a07343eead5ad49844726c6303fb97f4a8288dd5bdaea3fdb1115878ca9f3f4c3299492845bf624807e62b743d
-
C:\Users\Admin\AppData\Local\Temp\._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe
Filesize995KB
MD54a0b000b572b7f2583b3a1ac32b1cc8a
SHA114d9b879be947ae5ac9316d33b5b684bfb3c9850
SHA2564873671ac359c69c45fba604abed4e8c19abea443fe2aee1f51528603ba11d6e
SHA5121d458042f3949259f339b92b3a3e6cc2c070fd14dfcdd0d63db8aa80b327d4d9b75411e19b2bb4757db6aa41e3937f2dde4f7af01204106d1605e4d28e744b1e
-
Filesize
17KB
MD5af4d37aad8b34471da588360a43e768a
SHA183ed64667d4e68ea531b8bcf58aab3ed4a5ca998
SHA256e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1
SHA51274f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da