Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-11-2024 19:11
Behavioral task
behavioral1
Sample
e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe
Resource
win10v2004-20241007-en
General
-
Target
e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe
-
Size
2.5MB
-
MD5
048bc26f865c89de0e2925b5085ac680
-
SHA1
b36c32e65fdbfcd03e044a61fa58a556b918c069
-
SHA256
e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5e
-
SHA512
dd3b1154dbef4a2c286f04be86f61b6f7192adc10f8b18d3280fdbb82f5fda21130b8e1e998784f588815fd1a4a437ef3bbebad55d532c6eaeb9c083ea561bde
-
SSDEEP
49152:unsHyjtk2MYC5GDmSoZr3GzErU7fST52n6zRf9J:unsmtk2a1jazh7fDmRfD
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0008000000016ea1-18.dat acprotect -
Executes dropped EXE 3 IoCs
pid Process 2804 ._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 2704 Synaptics.exe 2728 ._cache_Synaptics.exe -
Loads dropped DLL 7 IoCs
pid Process 2552 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 2804 ._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 2552 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 2552 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 2704 Synaptics.exe 2704 Synaptics.exe 2728 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe -
resource yara_rule behavioral1/files/0x0008000000016ea1-18.dat upx behavioral1/memory/2804-20-0x0000000010000000-0x0000000010081000-memory.dmp upx behavioral1/memory/2728-43-0x0000000010000000-0x0000000010081000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2360 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2804 ._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 2728 ._cache_Synaptics.exe 2360 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2804 2552 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 30 PID 2552 wrote to memory of 2804 2552 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 30 PID 2552 wrote to memory of 2804 2552 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 30 PID 2552 wrote to memory of 2804 2552 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 30 PID 2552 wrote to memory of 2704 2552 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 31 PID 2552 wrote to memory of 2704 2552 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 31 PID 2552 wrote to memory of 2704 2552 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 31 PID 2552 wrote to memory of 2704 2552 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 31 PID 2704 wrote to memory of 2728 2704 Synaptics.exe 32 PID 2704 wrote to memory of 2728 2704 Synaptics.exe 32 PID 2704 wrote to memory of 2728 2704 Synaptics.exe 32 PID 2704 wrote to memory of 2728 2704 Synaptics.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe"C:\Users\Admin\AppData\Local\Temp\e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe"C:\Users\Admin\AppData\Local\Temp\._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2804
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2728
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2360
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5048bc26f865c89de0e2925b5085ac680
SHA1b36c32e65fdbfcd03e044a61fa58a556b918c069
SHA256e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5e
SHA512dd3b1154dbef4a2c286f04be86f61b6f7192adc10f8b18d3280fdbb82f5fda21130b8e1e998784f588815fd1a4a437ef3bbebad55d532c6eaeb9c083ea561bde
-
Filesize
17KB
MD5af4d37aad8b34471da588360a43e768a
SHA183ed64667d4e68ea531b8bcf58aab3ed4a5ca998
SHA256e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1
SHA51274f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da
-
\Users\Admin\AppData\Local\Temp\._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe
Filesize1.8MB
MD52408f3678daae195ce1790d4ce72f212
SHA1a0ebf04b3259f50aca5d076445b3b6a57935a1a9
SHA256a921395be8d70d9356080d19eeca3348e6c01be695d90c254cedbe2a1a75a270
SHA512c100a8701944fa701172a984737013214b9cefe080e916fb895d1ba27d02debbe84529736e348b4782428a6e1e49a57b4df1c62c0f7015e822a08a85c5e0c53f
-
Filesize
148KB
MD510a2f663fdc511fd52bfcfd0a8837549
SHA1e3669af6eeb82c20b10245caa4974cb727b52bf0
SHA256bd5f2e4ac7c2bea616fa60a50698b0d6d46a9456c08392a5c62c340d6f738eeb
SHA5127e54bcce8f6813873db102f010431ad1ba83d554e9c368c598d428a1b8e6bc10f3622e559c0daa9d5b1740aa6fc08a5d97bc3f23217035b929a64b0399ce9830