Analysis
-
max time kernel
113s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 19:11
Behavioral task
behavioral1
Sample
e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe
Resource
win10v2004-20241007-en
General
-
Target
e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe
-
Size
2.5MB
-
MD5
048bc26f865c89de0e2925b5085ac680
-
SHA1
b36c32e65fdbfcd03e044a61fa58a556b918c069
-
SHA256
e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5e
-
SHA512
dd3b1154dbef4a2c286f04be86f61b6f7192adc10f8b18d3280fdbb82f5fda21130b8e1e998784f588815fd1a4a437ef3bbebad55d532c6eaeb9c083ea561bde
-
SSDEEP
49152:unsHyjtk2MYC5GDmSoZr3GzErU7fST52n6zRf9J:unsmtk2a1jazh7fDmRfD
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0009000000023c62-96.dat acprotect -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 4036 ._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 1456 Synaptics.exe 5048 ._cache_Synaptics.exe -
Loads dropped DLL 2 IoCs
pid Process 4036 ._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 5048 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe -
resource yara_rule behavioral2/files/0x0009000000023c62-96.dat upx behavioral2/memory/4036-99-0x0000000010000000-0x0000000010081000-memory.dmp upx behavioral2/memory/5048-172-0x0000000010000000-0x0000000010081000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4148 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4036 ._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 5048 ._cache_Synaptics.exe 4148 EXCEL.EXE 4148 EXCEL.EXE 4148 EXCEL.EXE 4148 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 384 wrote to memory of 4036 384 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 85 PID 384 wrote to memory of 4036 384 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 85 PID 384 wrote to memory of 4036 384 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 85 PID 384 wrote to memory of 1456 384 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 86 PID 384 wrote to memory of 1456 384 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 86 PID 384 wrote to memory of 1456 384 e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe 86 PID 1456 wrote to memory of 5048 1456 Synaptics.exe 88 PID 1456 wrote to memory of 5048 1456 Synaptics.exe 88 PID 1456 wrote to memory of 5048 1456 Synaptics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe"C:\Users\Admin\AppData\Local\Temp\e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe"C:\Users\Admin\AppData\Local\Temp\._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4036
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5048
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5048bc26f865c89de0e2925b5085ac680
SHA1b36c32e65fdbfcd03e044a61fa58a556b918c069
SHA256e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5e
SHA512dd3b1154dbef4a2c286f04be86f61b6f7192adc10f8b18d3280fdbb82f5fda21130b8e1e998784f588815fd1a4a437ef3bbebad55d532c6eaeb9c083ea561bde
-
C:\Users\Admin\AppData\Local\Temp\._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe
Filesize1.8MB
MD52408f3678daae195ce1790d4ce72f212
SHA1a0ebf04b3259f50aca5d076445b3b6a57935a1a9
SHA256a921395be8d70d9356080d19eeca3348e6c01be695d90c254cedbe2a1a75a270
SHA512c100a8701944fa701172a984737013214b9cefe080e916fb895d1ba27d02debbe84529736e348b4782428a6e1e49a57b4df1c62c0f7015e822a08a85c5e0c53f
-
Filesize
17KB
MD5af4d37aad8b34471da588360a43e768a
SHA183ed64667d4e68ea531b8bcf58aab3ed4a5ca998
SHA256e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1
SHA51274f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da
-
Filesize
148KB
MD510a2f663fdc511fd52bfcfd0a8837549
SHA1e3669af6eeb82c20b10245caa4974cb727b52bf0
SHA256bd5f2e4ac7c2bea616fa60a50698b0d6d46a9456c08392a5c62c340d6f738eeb
SHA5127e54bcce8f6813873db102f010431ad1ba83d554e9c368c598d428a1b8e6bc10f3622e559c0daa9d5b1740aa6fc08a5d97bc3f23217035b929a64b0399ce9830