Analysis
-
max time kernel
112s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 15:05
Behavioral task
behavioral1
Sample
f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe
Resource
win10v2004-20241007-en
General
-
Target
f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe
-
Size
1.7MB
-
MD5
59fdd620fc7cd0cdb4ea8347c8a64980
-
SHA1
15cd837855597e4b96531a041e412e6d417ee07a
-
SHA256
f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890
-
SHA512
780195acc367e86c774bc4be7d5bce81b0990ac081ee7507e9d66dbdc773b01a8d4cf78ac7f0119333f755bb1b21df0096a11f9206f8d01409f73de24d626e6c
-
SSDEEP
49152:LnsHyjtk2MYC5GDXY80D4YSbxIWvbqmmdtL4i96UM:Lnsmtk2auYRmbSIKSi9Q
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 3248 ._cache_f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe 2400 Synaptics.exe 1980 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe -
resource yara_rule behavioral2/files/0x000c000000023ba7-6.dat upx behavioral2/memory/3248-127-0x0000000000400000-0x0000000001A73000-memory.dmp upx behavioral2/memory/3248-134-0x0000000000400000-0x0000000001A73000-memory.dmp upx behavioral2/memory/1980-194-0x0000000000400000-0x0000000001A73000-memory.dmp upx behavioral2/memory/1980-193-0x0000000000400000-0x0000000001A73000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2564 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4800 wrote to memory of 3248 4800 f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe 82 PID 4800 wrote to memory of 3248 4800 f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe 82 PID 4800 wrote to memory of 3248 4800 f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe 82 PID 4800 wrote to memory of 2400 4800 f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe 83 PID 4800 wrote to memory of 2400 4800 f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe 83 PID 4800 wrote to memory of 2400 4800 f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe 83 PID 2400 wrote to memory of 1980 2400 Synaptics.exe 84 PID 2400 wrote to memory of 1980 2400 Synaptics.exe 84 PID 2400 wrote to memory of 1980 2400 Synaptics.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe"C:\Users\Admin\AppData\Local\Temp\f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\._cache_f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3248
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1980
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD559fdd620fc7cd0cdb4ea8347c8a64980
SHA115cd837855597e4b96531a041e412e6d417ee07a
SHA256f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890
SHA512780195acc367e86c774bc4be7d5bce81b0990ac081ee7507e9d66dbdc773b01a8d4cf78ac7f0119333f755bb1b21df0096a11f9206f8d01409f73de24d626e6c
-
C:\Users\Admin\AppData\Local\Temp\._cache_f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe
Filesize979KB
MD58ce50fc290bed7711d97b16d5ffb49f6
SHA159cdc83c4d5f32ca1d5bdc32fe6656fadb27a72f
SHA256023b628b690f5185604fc7218dc4e9842604c7bd9f2e2c065f9360255cb39e49
SHA512455905bf556e9629c4ad1eea48ab1c4aa471462f289a74fbe6a06071a58e8cad2a31b686bd39e62e2e15be9bab2e64ea6c52d829738519eb159ca59609fc1ef9
-
Filesize
23KB
MD5190e459a0d27c24dc19703512b338092
SHA16b4ff5077a8ac6edc959c455a5563bc2106cd1ac
SHA256894a477000546848fc6b3d10ba9cf8daa9bbf4c50856448f9d570aef2e4b5154
SHA512b189de961f400970c4958a549ef8f8f64eb9b9c488ea3888e3f4643654b82a6afbf9b122075b1550ee1e08b6cf62c9a7bed3501d9b96c565f0eb25ea43311a4a
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04