Analysis
-
max time kernel
111s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 13:03
Behavioral task
behavioral1
Sample
8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe
Resource
win10v2004-20241007-en
General
-
Target
8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe
-
Size
1.0MB
-
MD5
1cb044b40268dd3e2ae0fad582ca64c7
-
SHA1
143b91beaabc4763437cb5011dba88711bff5c0c
-
SHA256
8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2
-
SHA512
eced676c344bf511bf7d88e28df0cb0060dfca501d57fab324f49aa6d200f2a67a74a23f75c8c8fca3cff3d464ac1a6d78a11e45135228c202002ef87994d4bb
-
SSDEEP
24576:WnsJ39LyjbJkQFMhmC+6GD97BI+G7Pfg+6vsssssssUSl:WnsHyjtk2MYC5GDlNG7HDSSl
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 236 ._cache_8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe 4564 Synaptics.exe 2364 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1892 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1892 EXCEL.EXE 1892 EXCEL.EXE 1892 EXCEL.EXE 1892 EXCEL.EXE 1892 EXCEL.EXE 1892 EXCEL.EXE 1892 EXCEL.EXE 1892 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4332 wrote to memory of 236 4332 8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe 86 PID 4332 wrote to memory of 236 4332 8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe 86 PID 4332 wrote to memory of 236 4332 8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe 86 PID 4332 wrote to memory of 4564 4332 8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe 87 PID 4332 wrote to memory of 4564 4332 8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe 87 PID 4332 wrote to memory of 4564 4332 8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe 87 PID 4564 wrote to memory of 2364 4564 Synaptics.exe 88 PID 4564 wrote to memory of 2364 4564 Synaptics.exe 88 PID 4564 wrote to memory of 2364 4564 Synaptics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe"C:\Users\Admin\AppData\Local\Temp\8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\._cache_8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe"C:\Users\Admin\AppData\Local\Temp\._cache_8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:236
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2364
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD51cb044b40268dd3e2ae0fad582ca64c7
SHA1143b91beaabc4763437cb5011dba88711bff5c0c
SHA2568069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2
SHA512eced676c344bf511bf7d88e28df0cb0060dfca501d57fab324f49aa6d200f2a67a74a23f75c8c8fca3cff3d464ac1a6d78a11e45135228c202002ef87994d4bb
-
C:\Users\Admin\AppData\Local\Temp\._cache_8069b87cebf6f6279b87d3a1c7b80bad49b92fbf4c52180d5878b1486ad51cf2.exe
Filesize296KB
MD5663484f6a1aac823ebeaa029d6520778
SHA15a96524ac697b0226899f4e73a546c2204475f50
SHA25672ee8f70039d3e6bbcae705664975a9631cac365117a1621bd92b514d10eacd0
SHA512020a1d0c589cca1d470f572df085c9be34933a839a0f4d83e0cc87d7d47415a59bb6916747603d9d188755d01fe8638ab6795567e9a9591a7ba381bff2215a88
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
23KB
MD511b4a078f3953aaff793beac53a20dde
SHA1074506502636cc531b94d52ecf9fbfd98af807b2
SHA256f1c617641ade42ecddd39d263a58318505e1e3c55612dc6756ce301748761f06
SHA51207103c40ffc0c7ccdbc71796ada0ff37369483cd889ffa2600a88821f15513e9a1d9aa75e60a67b6ad61ee0e5e1b36c09c209f123b0bf60d448c3aa54f580285