Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25-11-2024 12:55
Behavioral task
behavioral1
Sample
90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
Resource
win10v2004-20241007-en
General
-
Target
90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
-
Size
917KB
-
MD5
28d5c70bf040b71fc7863ebc2891c661
-
SHA1
853e7527e524397fff7118b4442955ca03b231f5
-
SHA256
90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761
-
SHA512
3a2ac093d9d3e0cd102c7e72d7a0512457db361335cc6373ea4aad01f14e3bd8c5f6e0520778c4ab05487426c12522c86cfcb1180a11d5f98ed3a6922f946288
-
SSDEEP
12288:wMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9nr3I5sUesDns6BAeRF:wnsJ39LyjbJkQFMhmC+6GD9r3+sXqnrX
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
resource behavioral1/files/0x00060000000195ca-117.dat -
Deletes itself 1 IoCs
pid Process 2704 Au_.exe -
Executes dropped EXE 5 IoCs
pid Process 2548 ._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 2704 Au_.exe 2744 Synaptics.exe 2648 ._cache_Synaptics.exe 1860 Bu_.exe -
Loads dropped DLL 17 IoCs
pid Process 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 2548 ._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 2704 Au_.exe 2704 Au_.exe 2744 Synaptics.exe 2744 Synaptics.exe 2648 ._cache_Synaptics.exe 1860 Bu_.exe 1860 Bu_.exe 2704 Au_.exe 1860 Bu_.exe 2704 Au_.exe 1860 Bu_.exe 2704 Au_.exe 1860 Bu_.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bu_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x000900000001225f-4.dat nsis_installer_1 -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2668 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2668 EXCEL.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2548 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 30 PID 2284 wrote to memory of 2548 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 30 PID 2284 wrote to memory of 2548 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 30 PID 2284 wrote to memory of 2548 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 30 PID 2284 wrote to memory of 2548 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 30 PID 2284 wrote to memory of 2548 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 30 PID 2284 wrote to memory of 2548 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 30 PID 2548 wrote to memory of 2704 2548 ._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 31 PID 2548 wrote to memory of 2704 2548 ._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 31 PID 2548 wrote to memory of 2704 2548 ._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 31 PID 2548 wrote to memory of 2704 2548 ._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 31 PID 2548 wrote to memory of 2704 2548 ._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 31 PID 2548 wrote to memory of 2704 2548 ._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 31 PID 2548 wrote to memory of 2704 2548 ._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 31 PID 2284 wrote to memory of 2744 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 32 PID 2284 wrote to memory of 2744 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 32 PID 2284 wrote to memory of 2744 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 32 PID 2284 wrote to memory of 2744 2284 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe 32 PID 2744 wrote to memory of 2648 2744 Synaptics.exe 33 PID 2744 wrote to memory of 2648 2744 Synaptics.exe 33 PID 2744 wrote to memory of 2648 2744 Synaptics.exe 33 PID 2744 wrote to memory of 2648 2744 Synaptics.exe 33 PID 2744 wrote to memory of 2648 2744 Synaptics.exe 33 PID 2744 wrote to memory of 2648 2744 Synaptics.exe 33 PID 2744 wrote to memory of 2648 2744 Synaptics.exe 33 PID 2648 wrote to memory of 1860 2648 ._cache_Synaptics.exe 34 PID 2648 wrote to memory of 1860 2648 ._cache_Synaptics.exe 34 PID 2648 wrote to memory of 1860 2648 ._cache_Synaptics.exe 34 PID 2648 wrote to memory of 1860 2648 ._cache_Synaptics.exe 34 PID 2648 wrote to memory of 1860 2648 ._cache_Synaptics.exe 34 PID 2648 wrote to memory of 1860 2648 ._cache_Synaptics.exe 34 PID 2648 wrote to memory of 1860 2648 ._cache_Synaptics.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe"C:\Users\Admin\AppData\Local\Temp\90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe"C:\Users\Admin\AppData\Local\Temp\._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\3⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2704
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe" InjUpdate _?=C:\Users\Admin\AppData\Local\Temp\4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1860
-
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
917KB
MD528d5c70bf040b71fc7863ebc2891c661
SHA1853e7527e524397fff7118b4442955ca03b231f5
SHA25690622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761
SHA5123a2ac093d9d3e0cd102c7e72d7a0512457db361335cc6373ea4aad01f14e3bd8c5f6e0520778c4ab05487426c12522c86cfcb1180a11d5f98ed3a6922f946288
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
20KB
MD5a218ea9c57d158fb2cd2dc84b39c9146
SHA134be906270cdc42443402ca0a92e17b6e9b735b2
SHA2561dba29d44b98fd037f628fceb818f4d84a8cf1bbf7ea86508549b650b9700d60
SHA512019a88df3a85fb9c802200feb900cb1c88ca2948c471b49bfa5798e023816fcee50034e8f3a44dcf1fcc6e2fc02c7de01581f6aa968a41fe374aa844bfb092a6
-
Filesize
23KB
MD51ba8e90bb0e56f929b0e855db7521089
SHA1a457ecc5b816734134905b8c6be42d4e014677a9
SHA25668c2cecc03daa331cfb119f06d24dc630404acb10dfcea6039d09e2343c80b9c
SHA5122d75c3e40cfb288b5ea87dce76721977ca978f83fc40715d92272bbbcb593dbf8d392f3888f7d500355ee4a468d5817a0b75ce0ed907179c09cc717178e69a6a
-
\Users\Admin\AppData\Local\Temp\._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
Filesize163KB
MD5b540b17cf251a822024653ff44165eb9
SHA1ed98b5af3c4b1823659672d64236632fcc18a3d3
SHA256ac55f3efd59c6a2d42251f0109f5fa713b806fdfc12511da2b2a09858fe81d01
SHA512e4ed1808cd578941ebc7d55a174714fb78743a8ea654b98e4ff9409db9acc06f2624e6d0f822cc09bbfad6d1f532ec9977cefec761dd02442ff86fa39738ee66
-
Filesize
100KB
MD50c2020b9cebdefe01d1ab1bf079ead52
SHA117bdbefce3f24c7b8817bb0499ef407f4bf0df2d
SHA25632fa6bae573848b5123734672039e808c9ce93e781f01e619b959c6c4e8fde72
SHA512fea74de5eca2d90fe6b35d3ad40ad2b7527448a5cd9f75eb2d549d4aa5e8cbb410a3d9a3b1f3a861689c5f45b949c87090f0349ad57f5918dd1b27e7b26b61fc
-
Filesize
9KB
MD50e4c4e4eb158e3f250ca9161156e74a5
SHA178d055856312c2b9f313877f7f72ca936554095a
SHA25660e6e287828dd882447a79018b505bb3be67b0f04fc8e022a57442e249588ed1
SHA512eba47ef4d16532df26f50e42bb5650733844ffc94b6f0e9037c2a2854326e9bcf1d6c967f541a655a91452c9357eb4ba1aedf85a2757a560ad4527a8f6b63ebc
-
Filesize
3KB
MD51923c3ce705616293c721d5dfc46b7a3
SHA1beec6bba81cc80e100243e6b26554e0c585f7734
SHA256921d31307a7e93270caa35093893b1799b055ffde2db3298fb9aa495ede7f9a2
SHA512b8d584db8fac7a8395e3e5e1fdf12c4d3e5d1bdd78ac00e7467b5c4d279c670834211076ada391b6f11fb833fc8b54f2b3b24d9ecd85727000b1c0138aac8b77
-
Filesize
164KB
MD59f392fdef8b0681254ad916cf0cf6961
SHA1ef903a0652696e5c0aad1b271916a1c212bdcee1
SHA2560e6a43834e7124c784f958756330dbdcba32bc397bc96fd8ce1672c8c173be27
SHA5125835042e78caea5ac25b2ce7c0490643c37890dd83424bf521ed67a97e2faaf95e2f8d9e7626b71f78c1d40e93dd61d3a175d149cf932042101d39fc09c2a77c