Analysis
-
max time kernel
112s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 15:29
Behavioral task
behavioral1
Sample
6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe
Resource
win10v2004-20241007-en
General
-
Target
6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe
-
Size
6.1MB
-
MD5
02bec9d86e4839199a60b334dd650e60
-
SHA1
8f86b49725abfae4c201654f3aa43ec0041cea39
-
SHA256
6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82
-
SHA512
660d932f4b2fe56d175ba3c2823a0501d13e29876766a57bd4df5b345177887b48fb9eedcf0c3929cca509f49a2bb189395e82c2418fa6e8834e0a2f79425243
-
SSDEEP
196608:iLmGZT4llVN1apVkFGT5KSPNOe7mBuyQzh:iyST4TlIGWK+N0BnQzh
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 4064 ._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe 1456 Synaptics.exe 2768 ._cache_Synaptics.exe -
Loads dropped DLL 2 IoCs
pid Process 4064 ._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe 2768 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe -
resource yara_rule behavioral2/files/0x000c000000023c16-5.dat upx behavioral2/memory/4064-61-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2768-168-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2768-178-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4064-199-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1020 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1020 EXCEL.EXE 1020 EXCEL.EXE 1020 EXCEL.EXE 1020 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3908 wrote to memory of 4064 3908 6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe 86 PID 3908 wrote to memory of 4064 3908 6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe 86 PID 3908 wrote to memory of 4064 3908 6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe 86 PID 3908 wrote to memory of 1456 3908 6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe 87 PID 3908 wrote to memory of 1456 3908 6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe 87 PID 3908 wrote to memory of 1456 3908 6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe 87 PID 1456 wrote to memory of 2768 1456 Synaptics.exe 88 PID 1456 wrote to memory of 2768 1456 Synaptics.exe 88 PID 1456 wrote to memory of 2768 1456 Synaptics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"C:\Users\Admin\AppData\Local\Temp\6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4064
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2768
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.1MB
MD502bec9d86e4839199a60b334dd650e60
SHA18f86b49725abfae4c201654f3aa43ec0041cea39
SHA2566346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82
SHA512660d932f4b2fe56d175ba3c2823a0501d13e29876766a57bd4df5b345177887b48fb9eedcf0c3929cca509f49a2bb189395e82c2418fa6e8834e0a2f79425243
-
C:\Users\Admin\AppData\Local\Temp\._cache_6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe
Filesize5.4MB
MD59c181b1351af9d8574df0aaeb0e278de
SHA116010baa64a7d21fe9c435abac13798ccfedd0cd
SHA2563e4de6797fb83963bf660c2da8fd0fd523130e6b48b7834ba48d3f635d4e1ece
SHA512a1b09027b8e5f1ddd2bc4952ed73b708791e10e7a80fe8d726d238cfbca3a539559776fdce26f0e454ebfa2826a0ef3897a27283341ce2ed2ca28a1d24d827f7
-
Filesize
17KB
MD5af4d37aad8b34471da588360a43e768a
SHA183ed64667d4e68ea531b8bcf58aab3ed4a5ca998
SHA256e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1
SHA51274f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da
-
Filesize
11KB
MD5a436db0c473a087eb61ff5c53c34ba27
SHA165ea67e424e75f5065132b539c8b2eda88aa0506
SHA25675ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d