xred | b3763fd28aaaed4351ed92096131e9fabd1e00b34b87bb2312efd611ad66a4d4

Analysis

max time kernel
62s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EMV Reader Writer Software.exe
Size

1.7MB
MD5

b419b88ad4736f6e14fae96431188b78
SHA1

5a805150faca002946601b12fe48d83f569d1003
SHA256

b3763fd28aaaed4351ed92096131e9fabd1e00b34b87bb2312efd611ad66a4d4
SHA512

7a959f1f3ad3c083662c6ab505757b8f8e9de4ec51187ef207bd34c68903dcc649b871ca662ff71ebcf9d176e016e9da5173ff9dbd0ca8824671678bf5bfd974
SSDEEP

24576:QnsJ39LyjbJkQFMhmC+6GD94n+PB8P/H9jXKZP57nP0eWcjGKZplchPT2IXw7ChL:QnsHyjtk2MYC5GDinl2J+6kw7A

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	._cache_EMV Reader Writer Software.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	tmp2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	SynTPHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	EMV Reader Writer Software.exe

Executes dropped EXE 13 IoCs

pid	Process
2092	._cache_EMV Reader Writer Software.exe
4684	Synaptics.exe
2024	SynTPHelper.exe
2036	EMV Reader Writer Software V8.exe
4528	tmp1.jpg
636	tmp2.exe
3288	._cache_Synaptics.exe
3224	SynTPHelper.exe
4032	EMV Reader Writer Software V8.exe
4856	emv.exe
2004	tmp1.jpg
2628	tmp2.exe
4100	SynTPHelper.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	EMV Reader Writer Software.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\emv.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\emv.exe"	tmp2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\emv.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\emv.exe"	tmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SynTPHelper.exe	SynTPHelper.exe
File opened for modification	C:\Windows\SynTPHelper.exe	SynTPHelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_EMV Reader Writer Software.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1.jpg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SynTPHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMV Reader Writer Software V8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SynTPHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMV Reader Writer Software V8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1.jpg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SynTPHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMV Reader Writer Software.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral1/files/0x000c000000023b33-5.dat	nsis_installer_1
behavioral1/files/0x000c000000023b33-5.dat	nsis_installer_2
behavioral1/files/0x000a000000023b94-39.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	EMV Reader Writer Software.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4856	emv.exe
3792	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3792	EXCEL.EXE
3792	EXCEL.EXE
3792	EXCEL.EXE
3792	EXCEL.EXE
3792	EXCEL.EXE
3792	EXCEL.EXE
3792	EXCEL.EXE
3792	EXCEL.EXE

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 2092	3576	EMV Reader Writer Software.exe	83
PID 3576 wrote to memory of 2092	3576	EMV Reader Writer Software.exe	83
PID 3576 wrote to memory of 2092	3576	EMV Reader Writer Software.exe	83
PID 3576 wrote to memory of 4684	3576	EMV Reader Writer Software.exe	84
PID 3576 wrote to memory of 4684	3576	EMV Reader Writer Software.exe	84
PID 3576 wrote to memory of 4684	3576	EMV Reader Writer Software.exe	84
PID 2092 wrote to memory of 2024	2092	._cache_EMV Reader Writer Software.exe	85
PID 2092 wrote to memory of 2024	2092	._cache_EMV Reader Writer Software.exe	85
PID 2092 wrote to memory of 2024	2092	._cache_EMV Reader Writer Software.exe	85
PID 2092 wrote to memory of 2036	2092	._cache_EMV Reader Writer Software.exe	86
PID 2092 wrote to memory of 2036	2092	._cache_EMV Reader Writer Software.exe	86
PID 2092 wrote to memory of 2036	2092	._cache_EMV Reader Writer Software.exe	86
PID 2036 wrote to memory of 3956	2036	EMV Reader Writer Software V8.exe	87
PID 2036 wrote to memory of 3956	2036	EMV Reader Writer Software V8.exe	87
PID 2036 wrote to memory of 3956	2036	EMV Reader Writer Software V8.exe	87
PID 3956 wrote to memory of 4528	3956	cmd.exe	89
PID 3956 wrote to memory of 4528	3956	cmd.exe	89
PID 3956 wrote to memory of 4528	3956	cmd.exe	89
PID 2036 wrote to memory of 628	2036	EMV Reader Writer Software V8.exe	90
PID 2036 wrote to memory of 628	2036	EMV Reader Writer Software V8.exe	90
PID 2036 wrote to memory of 628	2036	EMV Reader Writer Software V8.exe	90
PID 628 wrote to memory of 636	628	cmd.exe	92
PID 628 wrote to memory of 636	628	cmd.exe	92
PID 4684 wrote to memory of 3288	4684	Synaptics.exe	93
PID 4684 wrote to memory of 3288	4684	Synaptics.exe	93
PID 4684 wrote to memory of 3288	4684	Synaptics.exe	93
PID 3288 wrote to memory of 3224	3288	._cache_Synaptics.exe	94
PID 3288 wrote to memory of 3224	3288	._cache_Synaptics.exe	94
PID 3288 wrote to memory of 3224	3288	._cache_Synaptics.exe	94
PID 3288 wrote to memory of 4032	3288	._cache_Synaptics.exe	95
PID 3288 wrote to memory of 4032	3288	._cache_Synaptics.exe	95
PID 3288 wrote to memory of 4032	3288	._cache_Synaptics.exe	95
PID 4032 wrote to memory of 3940	4032	EMV Reader Writer Software V8.exe	96
PID 4032 wrote to memory of 3940	4032	EMV Reader Writer Software V8.exe	96
PID 4032 wrote to memory of 3940	4032	EMV Reader Writer Software V8.exe	96
PID 636 wrote to memory of 4856	636	tmp2.exe	98
PID 636 wrote to memory of 4856	636	tmp2.exe	98
PID 3940 wrote to memory of 2004	3940	cmd.exe	99
PID 3940 wrote to memory of 2004	3940	cmd.exe	99
PID 3940 wrote to memory of 2004	3940	cmd.exe	99
PID 4032 wrote to memory of 4816	4032	EMV Reader Writer Software V8.exe	100
PID 4032 wrote to memory of 4816	4032	EMV Reader Writer Software V8.exe	100
PID 4032 wrote to memory of 4816	4032	EMV Reader Writer Software V8.exe	100
PID 4816 wrote to memory of 2628	4816	cmd.exe	102
PID 4816 wrote to memory of 2628	4816	cmd.exe	102
PID 2024 wrote to memory of 4100	2024	SynTPHelper.exe	124
PID 2024 wrote to memory of 4100	2024	SynTPHelper.exe	124
PID 2024 wrote to memory of 4100	2024	SynTPHelper.exe	124

C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software.exe
"C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Users\Admin\AppData\Local\Temp\._cache_EMV Reader Writer Software.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_EMV Reader Writer Software.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\SynTPHelper.exe
      "C:\Windows\SynTPHelper.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4100
- - C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe
    "C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start %temp%\tmp1.jpg
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        
        C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4528
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start %temp%\tmp2.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:636
      - C:\Users\Admin\AppData\Local\Drpbx\emv.exe
        
        "C:\Users\Admin\AppData\Local\Drpbx\emv.exe" C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        
        PID:4856
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe
      "C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4032
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start %temp%\tmp1.jpg
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        
        C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2004
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start %temp%\tmp2.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2628

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.7MB

MD5
b419b88ad4736f6e14fae96431188b78

SHA1
5a805150faca002946601b12fe48d83f569d1003

SHA256
b3763fd28aaaed4351ed92096131e9fabd1e00b34b87bb2312efd611ad66a4d4

SHA512
7a959f1f3ad3c083662c6ab505757b8f8e9de4ec51187ef207bd34c68903dcc649b871ca662ff71ebcf9d176e016e9da5173ff9dbd0ca8824671678bf5bfd974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\tmp2.exe.log

Filesize
430B

MD5
de04f2e81c0501dee6d2f449fb6f3885

SHA1
761a51e13b7958c5ec2e51de258428eedec0ae51

SHA256
92e5dd3c966959c5a39d98226668f5a2745e16db2ebf034eb5ee5d5f160ed8bb

SHA512
65e64986ec8b0681d72b7ec9590abe4ed443be492a4085dc4d9a6428e8f2e92d9bf46733f95bdf6de8e9efc97f035ab66d4400e83ac75d359dacecd7870161a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SynTPHelper.exe.log

Filesize
319B

MD5
824ba7b7eed8b900a98dd25129c4cd83

SHA1
54478770b2158000ef365591d42977cb854453a1

SHA256
d182dd648c92e41cd62dccc65f130c07f0a96c03b32f907c3d1218e9aa5bda03

SHA512
ae4f3a9673711ecb6cc5d06874c587341d5094803923b53b6e982278fa64549d7acf866de165e23750facd55da556b6794c0d32f129f4087529c73acd4ffb11e

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_EMV Reader Writer Software.exe

Filesize
942KB

MD5
35d2469a266ad4cf08ee723ca74b843d

SHA1
979527e8c77baab1d5d42d290c482a03543b2ea3

SHA256
9a696e11bcdd0d59577c43613d983daad607ea2fe0b2562f9359c23643cda18b

SHA512
f884e24ee775c64d42e2c914e27403c31087e13bccb9c89eb4814c1eca91d84744640f9e112851a12ea4a907b2d210f9c81b372ce7bd04a97037876ff701509a

Download Submit
C:\Users\Admin\AppData\Local\Temp\D6C75E00

Filesize
25KB

MD5
a9ea082bbbd450ccdd0248c5156df321

SHA1
6dbae703bb65f7e108ef37141612b57edf1ff4e6

SHA256
4344c651f6703af0b2b22b59f8ae2e9c5fe0ae4e9a70aabf3598f0c5f48b0e12

SHA512
0bd2c6aea76232d9e3d5f9225593bee1bf475401c432cd26ad7cf1d2f94003d4b2858ff297d6a2075d40473f29696f46a4cf9b2a663d65038e483e41b3e4f048

Download Submit
C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe

Filesize
560KB

MD5
a03920ec643f26a5d38676c953e6f4f6

SHA1
3756009fafeb360bc7f4b95654d027326688b8f0

SHA256
a1de7bc1d00660b7416e91442bcb89dcb8a05351eb22f03f89258d9077e69a80

SHA512
c472251c1a2e76100a6065d8e2b5fc42b5cf1fd85d4e31850b0f12806afb8e8b3c86f63c7ac2bee3f0a3add77412f03192f8c9fc494dc12e74295c7083f61156

Download Submit
C:\Users\Admin\AppData\Local\Temp\QZOqT5DV.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe

Filesize
1.5MB

MD5
00291c15181baa184b62938cb519ba4c

SHA1
0691b2e7177466adf594352e27ebdfcd0d7aee90

SHA256
c4820b44454f5072937047af8fa53cabe7e21d3fdf0464581a70594b9f2a7f73

SHA512
f20a5d68b02f88fd94486e3158bf68af338eb6080b4aa75514c556cbbd3dda3044fc1bce1b5c3e37de8bb61277f60b0069a1480d8fd6412f4e020b0c3463cb80

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1.jpg

Filesize
118KB

MD5
c9a3ccf95369f53cd448fac94ff4e3b8

SHA1
48131cd75821aad01ace71277206b7c6d7d4925c

SHA256
dc32698c13de42e87913c6d90939186a56ca4586e0397df52ed85e47443ceef4

SHA512
eeec3a8dd76cee4a1d774f7f34766742c6b92d833f8a92adb251cb618924935d3fbaf5c386b7c5291489ad805d3233dfd8b41aaafd73851aa9b410b45ff86e3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2.exe

Filesize
13KB

MD5
913157f29b94106f5b6db18d04eb3c41

SHA1
c0e08c5557e38f4705c4c614586de7becdfeafaa

SHA256
cc4cd74a7db7edd8a16da7ff6fccf491bf61cc19ac73aae5843c56821d09272f

SHA512
4f075ffea2887f5db4cd80c15736740afbee81f3b9148b7cc458bc36095daa59555767d4481668c6e9b91881dcf0107c36b495dde5d3ecce99aaf4cb490a413b

Download Submit
memory/636-169-0x000000001BE60000-0x000000001C32E000-memory.dmp

Filesize
4.8MB

Download
memory/636-171-0x000000001C330000-0x000000001C3CC000-memory.dmp

Filesize
624KB

Download
memory/2036-159-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3576-113-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/3576-0-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/3792-204-0x00007FFD1FC70000-0x00007FFD1FC80000-memory.dmp

Filesize
64KB

Download
memory/3792-202-0x00007FFD1FC70000-0x00007FFD1FC80000-memory.dmp

Filesize
64KB

Download
memory/3792-207-0x00007FFD1D390000-0x00007FFD1D3A0000-memory.dmp

Filesize
64KB

Download
memory/3792-206-0x00007FFD1D390000-0x00007FFD1D3A0000-memory.dmp

Filesize
64KB

Download
memory/3792-205-0x00007FFD1FC70000-0x00007FFD1FC80000-memory.dmp

Filesize
64KB

Download
memory/3792-201-0x00007FFD1FC70000-0x00007FFD1FC80000-memory.dmp

Filesize
64KB

Download
memory/3792-203-0x00007FFD1FC70000-0x00007FFD1FC80000-memory.dmp

Filesize
64KB

Download
memory/4032-199-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/4528-130-0x0000000005C90000-0x0000000006234000-memory.dmp

Filesize
5.6MB

Download
memory/4528-155-0x00000000056E0000-0x0000000005772000-memory.dmp

Filesize
584KB

Download
memory/4528-160-0x00000000055E0000-0x00000000055EA000-memory.dmp

Filesize
40KB

Download
memory/4528-161-0x0000000005930000-0x0000000005986000-memory.dmp

Filesize
344KB

Download
memory/4528-128-0x0000000000BD0000-0x0000000000BF6000-memory.dmp

Filesize
152KB

Download
memory/4528-129-0x0000000005640000-0x00000000056DC000-memory.dmp

Filesize
624KB

Download
memory/4684-200-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/4684-254-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/4684-258-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/4856-194-0x000000001BC80000-0x000000001BC88000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads