Analysis

  • max time kernel
    120s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 11:24

General

  • Target

    b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe

  • Size

    3.2MB

  • MD5

    07c86dd4f62846c7916a480b4141b540

  • SHA1

    bae9b29b94a2380eeb7e28892d0610968f52dae8

  • SHA256

    b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67

  • SHA512

    79a38bfa48e59222fb38695c169f762bbd4f49ce2b93cb82303d78d871fefba61ef1d3d9b1c82f30f6dd208cc34878925f12ed798d1f17da41ad29cd7a71e487

  • SSDEEP

    98304:H3h6d68gwIteZNiiPwVpc3h6d68gwIteZNiiPwVp:HR668aaEL4R668aaEL

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe
    "C:\Users\Admin\AppData\Local\Temp\b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2768
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLznCuyzwk.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2516
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLznCuyzwk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEC54.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2200
    • C:\Users\Admin\AppData\Local\Temp\b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe
      "C:\Users\Admin\AppData\Local\Temp\b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Users\Admin\AppData\Local\Temp\._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:624
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4948
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4828
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLznCuyzwk.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3024
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLznCuyzwk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4997.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1656
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2200
          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2616
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2356

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    3.2MB

    MD5

    07c86dd4f62846c7916a480b4141b540

    SHA1

    bae9b29b94a2380eeb7e28892d0610968f52dae8

    SHA256

    b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67

    SHA512

    79a38bfa48e59222fb38695c169f762bbd4f49ce2b93cb82303d78d871fefba61ef1d3d9b1c82f30f6dd208cc34878925f12ed798d1f17da41ad29cd7a71e487

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    f48458a48bcad3f68f53d4ed4d12194c

    SHA1

    41a0efec3bf8d6bc388e285c58770dc2e4689696

    SHA256

    f200f0665935677d6cd505e181f2d98d9b8ac59ef585753785d9b2845e984afa

    SHA512

    335ae5b51fc57576aed870f8f0609fdf10e6b78f2e94685ba826a8730c413af4208d131f143608fb1010579772068409e6d2b94a88630bc9ccf1d2338a6b14ef

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    9319c30f0ea4d849212baa310cd1848b

    SHA1

    5f58989116b8fc558b0a9e6efd41b3516b13decd

    SHA256

    33e8692226a449f6d2d39bb223500e4cf9c465507b5763d320063e0db5915c6d

    SHA512

    8fbdb25cbb67062f9116053aa6ea11024e072bfab8cca5e1a757ca0a64e662aa02ba72d5ebfebfe5c4fa3cd36607885ee1406b24d39f477da62d0537a117e097

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    e52f2fefbc48efe933b8903ecca12f81

    SHA1

    d83d5aab62097050d406b4083877a9f25237b697

    SHA256

    577b9ac45f73ea561514b8d694efbdb648401e379bd77edaff9ef3a02f105bfb

    SHA512

    0193f0a7054b581f1671dba4bd09958384a811f6fc1d98b164262b31526893a768ce19e9ecde4f373ccf8e24c586e8834a5f17b0f8a15da3927501564d1eebb9

  • C:\Users\Admin\AppData\Local\Temp\._cache_b2557a9a3bf651c30a68ed6bbf287335e1739b4ce8875a0d095006c4156d5a67N.exe

    Filesize

    483KB

    MD5

    f3b57ccad1c0a308635e17aa591e4038

    SHA1

    ca67ad3c74523b844fc23563f7b288f0389fd645

    SHA256

    5ad6b9a917f35be0a1d66c771069c2143ad765737eedd85436acbc0f95a4c0e7

    SHA512

    5ed754a1b254e8a4b03e0445ac0081c94aaf179c2974827ce4ff10b7deb765d819243b2084212d7c91be9ddc07bf94f55e35f85564781b4124b61647a2f0977a

  • C:\Users\Admin\AppData\Local\Temp\4B585E00

    Filesize

    21KB

    MD5

    bc22982eab4b6a3e1e8361ee1bb676b4

    SHA1

    c47638e9ecc3147cc9ee1dfff2ca951bce42be29

    SHA256

    14d9d9a60e544737efadf30cb685b668eccc235cb501e7ecc069b84f3d8b3f4a

    SHA512

    430d35a05b78ccdc51f6cdc2a526ab539afe052b98671eeebd684a17249934131df7458e9f5ff60db615debe24f675bd3be934ecd8b49cf56a6fa39264c32cf0

  • C:\Users\Admin\AppData\Local\Temp\VOknnXJi.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zjbr2e1g.spg.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmpEC54.tmp

    Filesize

    1KB

    MD5

    065cc2a6af37de19c189a7c5cad3720a

    SHA1

    10fbf9b0e5c6c2be66cec64ec3e39aed738c671c

    SHA256

    7cde8467b4f11d818ad1b70ba6a16b1ff30126d037523857facdb47faf1c6d67

    SHA512

    53fd994c1a195e12d9a3bdf6b77196e1de0d3993d6e0f0b93afaf571f6f26dfa6dbcd956d4245fcd9b32551a4d03a31201a4596bfc352b6ff4b3debce0690bb0

  • memory/1592-43-0x0000000000400000-0x000000000053B000-memory.dmp

    Filesize

    1.2MB

  • memory/1592-37-0x0000000000400000-0x000000000053B000-memory.dmp

    Filesize

    1.2MB

  • memory/2200-375-0x0000000000400000-0x000000000053B000-memory.dmp

    Filesize

    1.2MB

  • memory/2200-340-0x0000000000400000-0x000000000053B000-memory.dmp

    Filesize

    1.2MB

  • memory/2200-337-0x0000000000400000-0x000000000053B000-memory.dmp

    Filesize

    1.2MB

  • memory/2200-338-0x0000000000400000-0x000000000053B000-memory.dmp

    Filesize

    1.2MB

  • memory/2200-218-0x0000000000400000-0x000000000053B000-memory.dmp

    Filesize

    1.2MB

  • memory/2356-279-0x00007FFCA3E90000-0x00007FFCA3EA0000-memory.dmp

    Filesize

    64KB

  • memory/2356-283-0x00007FFCA1E30000-0x00007FFCA1E40000-memory.dmp

    Filesize

    64KB

  • memory/2356-287-0x00007FFCA1E30000-0x00007FFCA1E40000-memory.dmp

    Filesize

    64KB

  • memory/2356-280-0x00007FFCA3E90000-0x00007FFCA3EA0000-memory.dmp

    Filesize

    64KB

  • memory/2356-278-0x00007FFCA3E90000-0x00007FFCA3EA0000-memory.dmp

    Filesize

    64KB

  • memory/2356-281-0x00007FFCA3E90000-0x00007FFCA3EA0000-memory.dmp

    Filesize

    64KB

  • memory/2356-282-0x00007FFCA3E90000-0x00007FFCA3EA0000-memory.dmp

    Filesize

    64KB

  • memory/2516-19-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-25-0x0000000006260000-0x00000000065B4000-memory.dmp

    Filesize

    3.3MB

  • memory/2516-20-0x0000000005770000-0x0000000005792000-memory.dmp

    Filesize

    136KB

  • memory/2516-189-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-21-0x0000000005810000-0x0000000005876000-memory.dmp

    Filesize

    408KB

  • memory/2516-22-0x0000000005880000-0x00000000058E6000-memory.dmp

    Filesize

    408KB

  • memory/2516-26-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-183-0x0000000007E70000-0x0000000007E78000-memory.dmp

    Filesize

    32KB

  • memory/2516-180-0x0000000007D80000-0x0000000007D8E000-memory.dmp

    Filesize

    56KB

  • memory/2516-167-0x0000000074F80000-0x0000000074FCC000-memory.dmp

    Filesize

    304KB

  • memory/2516-24-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB

  • memory/2768-165-0x0000000007F50000-0x00000000085CA000-memory.dmp

    Filesize

    6.5MB

  • memory/2768-161-0x00000000075B0000-0x0000000007653000-memory.dmp

    Filesize

    652KB

  • memory/2768-166-0x0000000007900000-0x000000000791A000-memory.dmp

    Filesize

    104KB

  • memory/2768-169-0x0000000007970000-0x000000000797A000-memory.dmp

    Filesize

    40KB

  • memory/2768-87-0x0000000006BA0000-0x0000000006BD2000-memory.dmp

    Filesize

    200KB

  • memory/2768-178-0x0000000007B80000-0x0000000007C16000-memory.dmp

    Filesize

    600KB

  • memory/2768-179-0x0000000007B00000-0x0000000007B11000-memory.dmp

    Filesize

    68KB

  • memory/2768-93-0x0000000074F80000-0x0000000074FCC000-memory.dmp

    Filesize

    304KB

  • memory/2768-181-0x0000000007B40000-0x0000000007B54000-memory.dmp

    Filesize

    80KB

  • memory/2768-182-0x0000000007C40000-0x0000000007C5A000-memory.dmp

    Filesize

    104KB

  • memory/2768-104-0x0000000006B80000-0x0000000006B9E000-memory.dmp

    Filesize

    120KB

  • memory/2768-53-0x0000000006A20000-0x0000000006A6C000-memory.dmp

    Filesize

    304KB

  • memory/2768-50-0x00000000065D0000-0x00000000065EE000-memory.dmp

    Filesize

    120KB

  • memory/2768-15-0x0000000005010000-0x0000000005046000-memory.dmp

    Filesize

    216KB

  • memory/2768-190-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB

  • memory/2768-17-0x0000000005700000-0x0000000005D28000-memory.dmp

    Filesize

    6.2MB

  • memory/2768-16-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB

  • memory/2768-18-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB

  • memory/2768-42-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB

  • memory/3024-258-0x00000000076A0000-0x0000000007743000-memory.dmp

    Filesize

    652KB

  • memory/3024-248-0x00000000709C0000-0x0000000070A0C000-memory.dmp

    Filesize

    304KB

  • memory/3024-276-0x0000000007990000-0x00000000079A1000-memory.dmp

    Filesize

    68KB

  • memory/3024-277-0x00000000079D0000-0x00000000079E4000-memory.dmp

    Filesize

    80KB

  • memory/3024-196-0x0000000005E70000-0x00000000061C4000-memory.dmp

    Filesize

    3.3MB

  • memory/3024-223-0x0000000006470000-0x00000000064BC000-memory.dmp

    Filesize

    304KB

  • memory/4828-264-0x00000000709C0000-0x0000000070A0C000-memory.dmp

    Filesize

    304KB

  • memory/5104-5-0x0000000005810000-0x000000000581A000-memory.dmp

    Filesize

    40KB

  • memory/5104-6-0x0000000006F10000-0x0000000006F28000-memory.dmp

    Filesize

    96KB

  • memory/5104-7-0x00000000746DE000-0x00000000746DF000-memory.dmp

    Filesize

    4KB

  • memory/5104-4-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB

  • memory/5104-3-0x00000000058E0000-0x0000000005972000-memory.dmp

    Filesize

    584KB

  • memory/5104-2-0x0000000005DF0000-0x0000000006394000-memory.dmp

    Filesize

    5.6MB

  • memory/5104-1-0x0000000000C20000-0x0000000000F64000-memory.dmp

    Filesize

    3.3MB

  • memory/5104-0-0x00000000746DE000-0x00000000746DF000-memory.dmp

    Filesize

    4KB

  • memory/5104-8-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB

  • memory/5104-10-0x0000000006FC0000-0x000000000705C000-memory.dmp

    Filesize

    624KB

  • memory/5104-9-0x0000000007220000-0x000000000739E000-memory.dmp

    Filesize

    1.5MB

  • memory/5104-49-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB