Analysis
-
max time kernel
112s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 15:42
Behavioral task
behavioral1
Sample
5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe
Resource
win10v2004-20241007-en
General
-
Target
5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe
-
Size
2.6MB
-
MD5
302391404e901048e2a1f18e80b8e190
-
SHA1
3cad45be4155ec0dbc2d5d79986db1016f80f321
-
SHA256
5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066
-
SHA512
938ae46e80a24ced573fb4f2e18d1a157872615f19dea8bc80c073ea33acf3d0b216214d9db053b5d6b64e5855df9b6e35ff8d20ec9963c115f9ae5458f07367
-
SSDEEP
49152:tnsHyjtk2MYC5GDyqe3f6GKjPq3uFpBxO5WVUMe01CS:tnsmtk2a2SiGgq3kw9MeOCS
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 5 IoCs
pid Process 4716 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 5108 Synaptics.exe 4948 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.tmp 1192 ._cache_Synaptics.exe 1516 ._cache_Synaptics.tmp -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3688 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1516 ._cache_Synaptics.tmp 4948 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.tmp -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3688 EXCEL.EXE 3688 EXCEL.EXE 3688 EXCEL.EXE 3688 EXCEL.EXE 3688 EXCEL.EXE 3688 EXCEL.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3220 wrote to memory of 4716 3220 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 83 PID 3220 wrote to memory of 4716 3220 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 83 PID 3220 wrote to memory of 4716 3220 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 83 PID 3220 wrote to memory of 5108 3220 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 84 PID 3220 wrote to memory of 5108 3220 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 84 PID 3220 wrote to memory of 5108 3220 5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 84 PID 4716 wrote to memory of 4948 4716 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 85 PID 4716 wrote to memory of 4948 4716 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 85 PID 4716 wrote to memory of 4948 4716 ._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe 85 PID 5108 wrote to memory of 1192 5108 Synaptics.exe 86 PID 5108 wrote to memory of 1192 5108 Synaptics.exe 86 PID 5108 wrote to memory of 1192 5108 Synaptics.exe 86 PID 1192 wrote to memory of 1516 1192 ._cache_Synaptics.exe 88 PID 1192 wrote to memory of 1516 1192 ._cache_Synaptics.exe 88 PID 1192 wrote to memory of 1516 1192 ._cache_Synaptics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe"C:\Users\Admin\AppData\Local\Temp\5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\is-7PK6N.tmp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.tmp"C:\Users\Admin\AppData\Local\Temp\is-7PK6N.tmp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.tmp" /SL5="$B004E,858074,845312,C:\Users\Admin\AppData\Local\Temp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4948
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\is-K1S0D.tmp\._cache_Synaptics.tmp"C:\Users\Admin\AppData\Local\Temp\is-K1S0D.tmp\._cache_Synaptics.tmp" /SL5="$60252,858074,845312,C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1516
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD55fe7fc1da52637a1b2838f9cb87fecc7
SHA113833279d638064e0ae9d435290ecdac9f8ed2d4
SHA2561e5c9277a18b62de6a3b5b44aee0306ce0134b0c880d4c8bc9cdf76c4ecf4384
SHA5125ff5a4267d970653ea10eee7e498b61d8332d316eb541957f49b9dbb34e1b4a077dee15a79caa73ee5fcbd43b13971a41a2137833ed0b917009c58354c47af28
-
Filesize
2.6MB
MD5302391404e901048e2a1f18e80b8e190
SHA13cad45be4155ec0dbc2d5d79986db1016f80f321
SHA2565524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066
SHA512938ae46e80a24ced573fb4f2e18d1a157872615f19dea8bc80c073ea33acf3d0b216214d9db053b5d6b64e5855df9b6e35ff8d20ec9963c115f9ae5458f07367
-
C:\Users\Admin\AppData\Local\Temp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.exe
Filesize1.8MB
MD5c169b6bd894dfb0f1065ffaa8e2c1865
SHA1105267ff5e0aa0aae8423f4c82d2808e1ad36ad1
SHA256aa0d7d0fc221d40ed87ad1081d3b1cbf391b8653de646eccfc4d5ab282930a73
SHA512d7dd10c03e22a4d5933544b3f61524eb40c74076cc40e98665747f63a69327bd98245381d0810609517e718a64a12af3160bf5c3e34761a7a97a0feeddbe4ecb
-
Filesize
22KB
MD598bd5f109b7a382a2d3b91c51bfda94f
SHA1e01b2500ebfbedad642d6643f9265fde357a0e19
SHA256c3f81744a0504178f14070d27b407f5a29733584669d5137cb7f3f7149c0ea4e
SHA512bc06b3f625384e403bbe83c58c4515c758d306377fd87eb546f8f75da209e257bc659129e2f23e7234e4c53f212977bad0cff46536c1623f23b7fc068b6fb2c7
-
C:\Users\Admin\AppData\Local\Temp\is-7PK6N.tmp\._cache_5524dee571eec0d6dff962e530a5fc9794647789348555e5a5a52b5c59aa3066N.tmp
Filesize3.0MB
MD5023324a9b1e2fefe6cb0da14e9740fc1
SHA114560263365010348442f04618cd8604c9358af1
SHA25621e16b1738e4cdffa08fe0f38c840f86e32bdc733fd76b32d1909eefb9821022
SHA512707c55fd7f03f88792400c733502feef927e9624a5afc45d8ca7065c67152a0de9724bb88b8a04c7d1958d608ad3c268569017790c8479ab27f77991486c0bcd
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04