Analysis
-
max time kernel
112s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 13:04
Behavioral task
behavioral1
Sample
2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe
Resource
win10v2004-20241007-en
General
-
Target
2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe
-
Size
1.7MB
-
MD5
433186db017b2b23e8dab25763de3240
-
SHA1
80f659c3a32a40310e81754fa403ae9ddb679e0e
-
SHA256
2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42c
-
SHA512
f12bb0b62d0ecae5dd1f4f6b894ad34eed4a26a07343eead5ad49844726c6303fb97f4a8288dd5bdaea3fdb1115878ca9f3f4c3299492845bf624807e62b743d
-
SSDEEP
24576:rnsJ39LyjbJkQFMhmC+6GD9GueLfaO9yaooJn0PfSYvMK4aimr5IsNftaiuv:rnsHyjtk2MYC5GDEjaOIS1475hkv
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 3000 ._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe 3448 Synaptics.exe 3940 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2896 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2896 EXCEL.EXE 2896 EXCEL.EXE 2896 EXCEL.EXE 2896 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3468 wrote to memory of 3000 3468 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe 85 PID 3468 wrote to memory of 3000 3468 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe 85 PID 3468 wrote to memory of 3000 3468 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe 85 PID 3468 wrote to memory of 3448 3468 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe 86 PID 3468 wrote to memory of 3448 3468 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe 86 PID 3468 wrote to memory of 3448 3468 2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe 86 PID 3448 wrote to memory of 3940 3448 Synaptics.exe 88 PID 3448 wrote to memory of 3940 3448 Synaptics.exe 88 PID 3448 wrote to memory of 3940 3448 Synaptics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe"C:\Users\Admin\AppData\Local\Temp\2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3000
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3940
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5433186db017b2b23e8dab25763de3240
SHA180f659c3a32a40310e81754fa403ae9ddb679e0e
SHA2562b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42c
SHA512f12bb0b62d0ecae5dd1f4f6b894ad34eed4a26a07343eead5ad49844726c6303fb97f4a8288dd5bdaea3fdb1115878ca9f3f4c3299492845bf624807e62b743d
-
C:\Users\Admin\AppData\Local\Temp\._cache_2b82a405c360bdb439ff624b15f7533129e11b8c591daa26455762c5e0acd42cN.exe
Filesize995KB
MD54a0b000b572b7f2583b3a1ac32b1cc8a
SHA114d9b879be947ae5ac9316d33b5b684bfb3c9850
SHA2564873671ac359c69c45fba604abed4e8c19abea443fe2aee1f51528603ba11d6e
SHA5121d458042f3949259f339b92b3a3e6cc2c070fd14dfcdd0d63db8aa80b327d4d9b75411e19b2bb4757db6aa41e3937f2dde4f7af01204106d1605e4d28e744b1e
-
Filesize
17KB
MD5af4d37aad8b34471da588360a43e768a
SHA183ed64667d4e68ea531b8bcf58aab3ed4a5ca998
SHA256e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1
SHA51274f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da