Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-11-2024 18:02
Behavioral task
behavioral1
Sample
d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe
Resource
win10v2004-20241007-en
General
-
Target
d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe
-
Size
1.0MB
-
MD5
ae704fd66d555252ebcad782ec4835c0
-
SHA1
9f7a23a25ea89db5e3e852d4296f7728c686c0df
-
SHA256
d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484b
-
SHA512
cfe0cb3103372ace1fc55f7c352b68c0f55899c79e51dd6fde2ef4988d162adeb70113384d9f3f6b0221334ef3511c005900f29a7f5ce6c731ec956a3906571f
-
SSDEEP
24576:WnsJ39LyjbJkQFMhmC+6GD97BI+G7Pfg+6vsssssssUSF:WnsHyjtk2MYC5GDlNG7HDSSF
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
resource behavioral1/files/0x000600000001a495-83.dat -
Executes dropped EXE 3 IoCs
pid Process 2340 ._cache_d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe 2508 Synaptics.exe 2460 ._cache_Synaptics.exe -
Loads dropped DLL 5 IoCs
pid Process 2068 d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe 2068 d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe 2068 d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe 2508 Synaptics.exe 2508 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2896 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2896 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2340 2068 d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe 31 PID 2068 wrote to memory of 2340 2068 d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe 31 PID 2068 wrote to memory of 2340 2068 d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe 31 PID 2068 wrote to memory of 2340 2068 d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe 31 PID 2068 wrote to memory of 2508 2068 d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe 32 PID 2068 wrote to memory of 2508 2068 d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe 32 PID 2068 wrote to memory of 2508 2068 d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe 32 PID 2068 wrote to memory of 2508 2068 d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe 32 PID 2508 wrote to memory of 2460 2508 Synaptics.exe 33 PID 2508 wrote to memory of 2460 2508 Synaptics.exe 33 PID 2508 wrote to memory of 2460 2508 Synaptics.exe 33 PID 2508 wrote to memory of 2460 2508 Synaptics.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe"C:\Users\Admin\AppData\Local\Temp\d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\._cache_d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe"C:\Users\Admin\AppData\Local\Temp\._cache_d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2340
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2460
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5ae704fd66d555252ebcad782ec4835c0
SHA19f7a23a25ea89db5e3e852d4296f7728c686c0df
SHA256d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484b
SHA512cfe0cb3103372ace1fc55f7c352b68c0f55899c79e51dd6fde2ef4988d162adeb70113384d9f3f6b0221334ef3511c005900f29a7f5ce6c731ec956a3906571f
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
25KB
MD5fbeb7ebf42fa93ce67080566f41cc053
SHA1b18a7685cab177c3bce3d445b27fc2586e1ff141
SHA25651b029c5d12a9b669e3ab0f9cebd216840a10d1878e6b28b4ccdd02356a9df61
SHA51208fb0e3d30e568d96f8ee8ec4e55ddc943b7ea12e61a655de4334e8685afb7dc6e2b617a0b2382695ffb711fd3b5c178edaf3dfc395021646fe5b40318538524
-
Filesize
21KB
MD528778706de3d3cd7720afbe5fb0e891c
SHA16f8b150da0e7fa42ade60b0d9289e78f28b047bc
SHA25684d407c1131626eae96a73d2df7e3b6ebc5a0a0e07eb25f6dbc7e5b62e619d01
SHA512a684584b846a467afa6b7fbf987257ee32e409645ca27b3a60589213027e2510eb5185fd206aba247d1d030ac4bb959691c894bcefc7d2073a1cdfef38eff630
-
Filesize
27KB
MD5caf031ab9635a4bff7730c9544dd13a8
SHA1a37b459b7e372df5ac4f484341f5ac1f0da3b93a
SHA25612acc7fcc55347cce9f163fc2cc51c052493b4571278c5d56641f988babd4cef
SHA512c0a4130df05da7294d92dab5402d34e31569c42d1317546e4034fd83d095be8aeef72db082f4eb67cdacf70dd6ddb5449424dd28a6011401054704ba6fe85dd3
-
Filesize
25KB
MD58c1e24eb28cf306a1dbc9c94b1963b1d
SHA104d6d32695a4e2df47695e0073cd5725396331bd
SHA256470e961b65f66c2a17491a6b02a66dd14390a470262037553b00a55d83284ef5
SHA5128d2a8287eb63178bba88b98eee0360e7334c7a014b861004c4d440b476ef276ff1c2702dfb0a248c5f63fbc0d4a8550b4699220189fba0cc0a7bf3993004ef00
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
\Users\Admin\AppData\Local\Temp\._cache_d20f4c00226eb4b40b0147213356c0b166022a32ec11f778213a4951e2be484bN.exe
Filesize296KB
MD5663484f6a1aac823ebeaa029d6520778
SHA15a96524ac697b0226899f4e73a546c2204475f50
SHA25672ee8f70039d3e6bbcae705664975a9631cac365117a1621bd92b514d10eacd0
SHA512020a1d0c589cca1d470f572df085c9be34933a839a0f4d83e0cc87d7d47415a59bb6916747603d9d188755d01fe8638ab6795567e9a9591a7ba381bff2215a88