Analysis
-
max time kernel
111s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 15:42
Behavioral task
behavioral1
Sample
5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe
Resource
win10v2004-20241007-en
General
-
Target
5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe
-
Size
2.6MB
-
MD5
302391404e901048e2a1f18e80b8e190
-
SHA1
3cad45be4155ec0dbc2d5d79986db1016f80f321
-
SHA256
5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066
-
SHA512
938ae46e80a24ced573fb4f2e18d1a157872615f19dea8bc80c073ea33acf3d0b216214d9db053b5d6b64e5855df9b6e35ff8d20ec9963c115f9ae5458f07367
-
SSDEEP
49152:tnsHyjtk2MYC5GDyqe3f6GKjPq3uFpBxO5WVUMe01CS:tnsmtk2a2SiGgq3kw9MeOCS
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 5 IoCs
pid Process 2824 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 2940 Synaptics.exe 2632 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.tmp 2720 ._cache_Synaptics.exe 2544 ._cache_Synaptics.tmp -
Loads dropped DLL 7 IoCs
pid Process 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 2824 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 2940 Synaptics.exe 2940 Synaptics.exe 2720 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1776 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2544 ._cache_Synaptics.tmp 2632 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1776 EXCEL.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2824 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 30 PID 2472 wrote to memory of 2824 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 30 PID 2472 wrote to memory of 2824 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 30 PID 2472 wrote to memory of 2824 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 30 PID 2472 wrote to memory of 2824 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 30 PID 2472 wrote to memory of 2824 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 30 PID 2472 wrote to memory of 2824 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 30 PID 2472 wrote to memory of 2940 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 32 PID 2472 wrote to memory of 2940 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 32 PID 2472 wrote to memory of 2940 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 32 PID 2472 wrote to memory of 2940 2472 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 32 PID 2824 wrote to memory of 2632 2824 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 31 PID 2824 wrote to memory of 2632 2824 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 31 PID 2824 wrote to memory of 2632 2824 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 31 PID 2824 wrote to memory of 2632 2824 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 31 PID 2824 wrote to memory of 2632 2824 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 31 PID 2824 wrote to memory of 2632 2824 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 31 PID 2824 wrote to memory of 2632 2824 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 31 PID 2940 wrote to memory of 2720 2940 Synaptics.exe 33 PID 2940 wrote to memory of 2720 2940 Synaptics.exe 33 PID 2940 wrote to memory of 2720 2940 Synaptics.exe 33 PID 2940 wrote to memory of 2720 2940 Synaptics.exe 33 PID 2940 wrote to memory of 2720 2940 Synaptics.exe 33 PID 2940 wrote to memory of 2720 2940 Synaptics.exe 33 PID 2940 wrote to memory of 2720 2940 Synaptics.exe 33 PID 2720 wrote to memory of 2544 2720 ._cache_Synaptics.exe 35 PID 2720 wrote to memory of 2544 2720 ._cache_Synaptics.exe 35 PID 2720 wrote to memory of 2544 2720 ._cache_Synaptics.exe 35 PID 2720 wrote to memory of 2544 2720 ._cache_Synaptics.exe 35 PID 2720 wrote to memory of 2544 2720 ._cache_Synaptics.exe 35 PID 2720 wrote to memory of 2544 2720 ._cache_Synaptics.exe 35 PID 2720 wrote to memory of 2544 2720 ._cache_Synaptics.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe"C:\Users\Admin\AppData\Local\Temp\5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\is-5MQ4L.tmp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.tmp"C:\Users\Admin\AppData\Local\Temp\is-5MQ4L.tmp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.tmp" /SL5="$A018C,858074,845312,C:\Users\Admin\AppData\Local\Temp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2632
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\is-QIS7N.tmp\._cache_Synaptics.tmp"C:\Users\Admin\AppData\Local\Temp\is-QIS7N.tmp\._cache_Synaptics.tmp" /SL5="$5011E,858074,845312,C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2544
-
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD55fe7fc1da52637a1b2838f9cb87fecc7
SHA113833279d638064e0ae9d435290ecdac9f8ed2d4
SHA2561e5c9277a18b62de6a3b5b44aee0306ce0134b0c880d4c8bc9cdf76c4ecf4384
SHA5125ff5a4267d970653ea10eee7e498b61d8332d316eb541957f49b9dbb34e1b4a077dee15a79caa73ee5fcbd43b13971a41a2137833ed0b917009c58354c47af28
-
Filesize
2.6MB
MD5302391404e901048e2a1f18e80b8e190
SHA13cad45be4155ec0dbc2d5d79986db1016f80f321
SHA2565524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066
SHA512938ae46e80a24ced573fb4f2e18d1a157872615f19dea8bc80c073ea33acf3d0b216214d9db053b5d6b64e5855df9b6e35ff8d20ec9963c115f9ae5458f07367
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
\Users\Admin\AppData\Local\Temp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe
Filesize1.8MB
MD5c169b6bd894dfb0f1065ffaa8e2c1865
SHA1105267ff5e0aa0aae8423f4c82d2808e1ad36ad1
SHA256aa0d7d0fc221d40ed87ad1081d3b1cbf391b8653de646eccfc4d5ab282930a73
SHA512d7dd10c03e22a4d5933544b3f61524eb40c74076cc40e98665747f63a69327bd98245381d0810609517e718a64a12af3160bf5c3e34761a7a97a0feeddbe4ecb
-
\Users\Admin\AppData\Local\Temp\is-5MQ4L.tmp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.tmp
Filesize3.0MB
MD5023324a9b1e2fefe6cb0da14e9740fc1
SHA114560263365010348442f04618cd8604c9358af1
SHA25621e16b1738e4cdffa08fe0f38c840f86e32bdc733fd76b32d1909eefb9821022
SHA512707c55fd7f03f88792400c733502feef927e9624a5afc45d8ca7065c67152a0de9724bb88b8a04c7d1958d608ad3c268569017790c8479ab27f77991486c0bcd