xred | b3763fd28aaaed4351ed92096131e9fabd1e00b34b87bb2312efd611ad66a4d4

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/12/2024, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

EMVReaderWriterSoftware.exe
Size

1.7MB
MD5

b419b88ad4736f6e14fae96431188b78
SHA1

5a805150faca002946601b12fe48d83f569d1003
SHA256

b3763fd28aaaed4351ed92096131e9fabd1e00b34b87bb2312efd611ad66a4d4
SHA512

7a959f1f3ad3c083662c6ab505757b8f8e9de4ec51187ef207bd34c68903dcc649b871ca662ff71ebcf9d176e016e9da5173ff9dbd0ca8824671678bf5bfd974
SSDEEP

24576:QnsJ39LyjbJkQFMhmC+6GD94n+PB8P/H9jXKZP57nP0eWcjGKZplchPT2IXw7ChL:QnsHyjtk2MYC5GDinl2J+6kw7A

Score

10^/10

xred backdoor discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
760	netsh.exe

Executes dropped EXE 14 IoCs

pid	Process
2692	._cache_EMVReaderWriterSoftware.exe
2572	SynTPHelper.exe
2848	Synaptics.exe
2656	EMV Reader Writer Software V8.exe
1932	._cache_Synaptics.exe
2376	EMV Reader Writer Software V8.exe
3008	SynTPHelper.exe
484	tmp1.jpg
1708	tmp2.exe
600	tmp1.jpg
2944	tmp2.exe
2236	emv.exe
2120	emv.exe
792	SynTPHelper.exe

Loads dropped DLL 17 IoCs

pid	Process
2664	EMVReaderWriterSoftware.exe
2692	._cache_EMVReaderWriterSoftware.exe
2664	EMVReaderWriterSoftware.exe
2664	EMVReaderWriterSoftware.exe
2692	._cache_EMVReaderWriterSoftware.exe
2692	._cache_EMVReaderWriterSoftware.exe
2848	Synaptics.exe
2848	Synaptics.exe
1932	._cache_Synaptics.exe
1932	._cache_Synaptics.exe
1932	._cache_Synaptics.exe
1504	cmd.exe
2400	cmd.exe
2400	cmd.exe
2520	cmd.exe
1504	cmd.exe
2116	cmd.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	EMVReaderWriterSoftware.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\emv.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\emv.exe"	tmp2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\emv.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\emv.exe"	tmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SynTPHelper.exe	SynTPHelper.exe
File opened for modification	C:\Windows\SynTPHelper.exe	SynTPHelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1.jpg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMV Reader Writer Software V8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SynTPHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_EMVReaderWriterSoftware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SynTPHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SynTPHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1.jpg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMVReaderWriterSoftware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMV Reader Writer Software V8.exe

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral1/files/0x000a0000000122ce-4.dat	nsis_installer_1
behavioral1/files/0x000a0000000122ce-4.dat	nsis_installer_2
behavioral1/files/0x0008000000015d19-13.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
2884	EXCEL.EXE
2120	emv.exe
2236	emv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe
792	SynTPHelper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
792	SynTPHelper.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	SynTPHelper.exe
Token: 33	792	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	792	SynTPHelper.exe
Token: 33	792	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	792	SynTPHelper.exe
Token: 33	792	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	792	SynTPHelper.exe
Token: 33	792	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	792	SynTPHelper.exe
Token: 33	792	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	792	SynTPHelper.exe
Token: 33	792	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	792	SynTPHelper.exe
Token: 33	792	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	792	SynTPHelper.exe
Token: 33	792	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	792	SynTPHelper.exe
Token: 33	792	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	792	SynTPHelper.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2884	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2692	2664	EMVReaderWriterSoftware.exe	31
PID 2664 wrote to memory of 2692	2664	EMVReaderWriterSoftware.exe	31
PID 2664 wrote to memory of 2692	2664	EMVReaderWriterSoftware.exe	31
PID 2664 wrote to memory of 2692	2664	EMVReaderWriterSoftware.exe	31
PID 2692 wrote to memory of 2572	2692	._cache_EMVReaderWriterSoftware.exe	32
PID 2692 wrote to memory of 2572	2692	._cache_EMVReaderWriterSoftware.exe	32
PID 2692 wrote to memory of 2572	2692	._cache_EMVReaderWriterSoftware.exe	32
PID 2692 wrote to memory of 2572	2692	._cache_EMVReaderWriterSoftware.exe	32
PID 2664 wrote to memory of 2848	2664	EMVReaderWriterSoftware.exe	33
PID 2664 wrote to memory of 2848	2664	EMVReaderWriterSoftware.exe	33
PID 2664 wrote to memory of 2848	2664	EMVReaderWriterSoftware.exe	33
PID 2664 wrote to memory of 2848	2664	EMVReaderWriterSoftware.exe	33
PID 2692 wrote to memory of 2656	2692	._cache_EMVReaderWriterSoftware.exe	34
PID 2692 wrote to memory of 2656	2692	._cache_EMVReaderWriterSoftware.exe	34
PID 2692 wrote to memory of 2656	2692	._cache_EMVReaderWriterSoftware.exe	34
PID 2692 wrote to memory of 2656	2692	._cache_EMVReaderWriterSoftware.exe	34
PID 2656 wrote to memory of 1504	2656	EMV Reader Writer Software V8.exe	35
PID 2656 wrote to memory of 1504	2656	EMV Reader Writer Software V8.exe	35
PID 2656 wrote to memory of 1504	2656	EMV Reader Writer Software V8.exe	35
PID 2656 wrote to memory of 1504	2656	EMV Reader Writer Software V8.exe	35
PID 2848 wrote to memory of 1932	2848	Synaptics.exe	37
PID 2848 wrote to memory of 1932	2848	Synaptics.exe	37
PID 2848 wrote to memory of 1932	2848	Synaptics.exe	37
PID 2848 wrote to memory of 1932	2848	Synaptics.exe	37
PID 1932 wrote to memory of 3008	1932	._cache_Synaptics.exe	39
PID 1932 wrote to memory of 3008	1932	._cache_Synaptics.exe	39
PID 1932 wrote to memory of 3008	1932	._cache_Synaptics.exe	39
PID 1932 wrote to memory of 3008	1932	._cache_Synaptics.exe	39
PID 1932 wrote to memory of 2376	1932	._cache_Synaptics.exe	40
PID 1932 wrote to memory of 2376	1932	._cache_Synaptics.exe	40
PID 1932 wrote to memory of 2376	1932	._cache_Synaptics.exe	40
PID 1932 wrote to memory of 2376	1932	._cache_Synaptics.exe	40
PID 2376 wrote to memory of 2400	2376	EMV Reader Writer Software V8.exe	41
PID 2376 wrote to memory of 2400	2376	EMV Reader Writer Software V8.exe	41
PID 2376 wrote to memory of 2400	2376	EMV Reader Writer Software V8.exe	41
PID 2376 wrote to memory of 2400	2376	EMV Reader Writer Software V8.exe	41
PID 2400 wrote to memory of 484	2400	cmd.exe	44
PID 2400 wrote to memory of 484	2400	cmd.exe	44
PID 2400 wrote to memory of 484	2400	cmd.exe	44
PID 2400 wrote to memory of 484	2400	cmd.exe	44
PID 2376 wrote to memory of 2520	2376	EMV Reader Writer Software V8.exe	45
PID 2376 wrote to memory of 2520	2376	EMV Reader Writer Software V8.exe	45
PID 2376 wrote to memory of 2520	2376	EMV Reader Writer Software V8.exe	45
PID 2376 wrote to memory of 2520	2376	EMV Reader Writer Software V8.exe	45
PID 2520 wrote to memory of 1708	2520	cmd.exe	47
PID 2520 wrote to memory of 1708	2520	cmd.exe	47
PID 2520 wrote to memory of 1708	2520	cmd.exe	47
PID 2520 wrote to memory of 1708	2520	cmd.exe	47
PID 1504 wrote to memory of 600	1504	cmd.exe	42
PID 1504 wrote to memory of 600	1504	cmd.exe	42
PID 1504 wrote to memory of 600	1504	cmd.exe	42
PID 1504 wrote to memory of 600	1504	cmd.exe	42
PID 2656 wrote to memory of 2116	2656	EMV Reader Writer Software V8.exe	48
PID 2656 wrote to memory of 2116	2656	EMV Reader Writer Software V8.exe	48
PID 2656 wrote to memory of 2116	2656	EMV Reader Writer Software V8.exe	48
PID 2656 wrote to memory of 2116	2656	EMV Reader Writer Software V8.exe	48
PID 2116 wrote to memory of 2944	2116	cmd.exe	50
PID 2116 wrote to memory of 2944	2116	cmd.exe	50
PID 2116 wrote to memory of 2944	2116	cmd.exe	50
PID 2116 wrote to memory of 2944	2116	cmd.exe	50
PID 2944 wrote to memory of 2236	2944	tmp2.exe	51
PID 2944 wrote to memory of 2236	2944	tmp2.exe	51
PID 2944 wrote to memory of 2236	2944	tmp2.exe	51
PID 1708 wrote to memory of 2120	1708	tmp2.exe	52

C:\Users\Admin\AppData\Local\Temp\EMVReaderWriterSoftware.exe
"C:\Users\Admin\AppData\Local\Temp\EMVReaderWriterSoftware.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Users\Admin\AppData\Local\Temp\._cache_EMVReaderWriterSoftware.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_EMVReaderWriterSoftware.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2572
- - C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe
    "C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start %temp%\tmp1.jpg
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        
        C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start %temp%\tmp2.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Drpbx\emv.exe
        
        "C:\Users\Admin\AppData\Local\Drpbx\emv.exe" C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        
        PID:2236
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:3008
    - - C:\Windows\SynTPHelper.exe
        
        "C:\Windows\SynTPHelper.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:792
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\SynTPHelper.exe" "SynTPHelper.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:760
  - - C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe
      "C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start %temp%\tmp1.jpg
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        
        C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:484
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start %temp%\tmp2.exe
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Drpbx\emv.exe
        
        "C:\Users\Admin\AppData\Local\Drpbx\emv.exe" C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        7⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        
        PID:2120

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.7MB

MD5
b419b88ad4736f6e14fae96431188b78

SHA1
5a805150faca002946601b12fe48d83f569d1003

SHA256
b3763fd28aaaed4351ed92096131e9fabd1e00b34b87bb2312efd611ad66a4d4

SHA512
7a959f1f3ad3c083662c6ab505757b8f8e9de4ec51187ef207bd34c68903dcc649b871ca662ff71ebcf9d176e016e9da5173ff9dbd0ca8824671678bf5bfd974

Download Submit
C:\Users\Admin\AppData\Local\Temp\1QnSJxrX.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\1QnSJxrX.xlsm

Filesize
24KB

MD5
80316225f32fcde3fc51c9023e0707b2

SHA1
e1530a11f964814bd52a167da3af94ac32c678ec

SHA256
d8655a898c9e0e1f3b1c82fb5ec95c989a1f95f21ffa646ad9457728a2fdc0b9

SHA512
d8db33097e0a573d6f5a9e680443ff245e1240112aecac89d834be49f1f2925b70f01cf1dfbfda1105ed0d15fd58c8f925997ba84296bd8c9e5d9852a90bc4a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1.jpg

Filesize
118KB

MD5
c9a3ccf95369f53cd448fac94ff4e3b8

SHA1
48131cd75821aad01ace71277206b7c6d7d4925c

SHA256
dc32698c13de42e87913c6d90939186a56ca4586e0397df52ed85e47443ceef4

SHA512
eeec3a8dd76cee4a1d774f7f34766742c6b92d833f8a92adb251cb618924935d3fbaf5c386b7c5291489ad805d3233dfd8b41aaafd73851aa9b410b45ff86e3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2.exe

Filesize
13KB

MD5
913157f29b94106f5b6db18d04eb3c41

SHA1
c0e08c5557e38f4705c4c614586de7becdfeafaa

SHA256
cc4cd74a7db7edd8a16da7ff6fccf491bf61cc19ac73aae5843c56821d09272f

SHA512
4f075ffea2887f5db4cd80c15736740afbee81f3b9148b7cc458bc36095daa59555767d4481668c6e9b91881dcf0107c36b495dde5d3ecce99aaf4cb490a413b

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_EMVReaderWriterSoftware.exe

Filesize
942KB

MD5
35d2469a266ad4cf08ee723ca74b843d

SHA1
979527e8c77baab1d5d42d290c482a03543b2ea3

SHA256
9a696e11bcdd0d59577c43613d983daad607ea2fe0b2562f9359c23643cda18b

SHA512
f884e24ee775c64d42e2c914e27403c31087e13bccb9c89eb4814c1eca91d84744640f9e112851a12ea4a907b2d210f9c81b372ce7bd04a97037876ff701509a

Download Submit
\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe

Filesize
560KB

MD5
a03920ec643f26a5d38676c953e6f4f6

SHA1
3756009fafeb360bc7f4b95654d027326688b8f0

SHA256
a1de7bc1d00660b7416e91442bcb89dcb8a05351eb22f03f89258d9077e69a80

SHA512
c472251c1a2e76100a6065d8e2b5fc42b5cf1fd85d4e31850b0f12806afb8e8b3c86f63c7ac2bee3f0a3add77412f03192f8c9fc494dc12e74295c7083f61156

Download Submit
\Users\Admin\AppData\Local\Temp\SynTPHelper.exe

Filesize
1.5MB

MD5
00291c15181baa184b62938cb519ba4c

SHA1
0691b2e7177466adf594352e27ebdfcd0d7aee90

SHA256
c4820b44454f5072937047af8fa53cabe7e21d3fdf0464581a70594b9f2a7f73

SHA512
f20a5d68b02f88fd94486e3158bf68af338eb6080b4aa75514c556cbbd3dda3044fc1bce1b5c3e37de8bb61277f60b0069a1480d8fd6412f4e020b0c3463cb80

Download Submit
memory/600-89-0x0000000000F90000-0x0000000000FB6000-memory.dmp

Filesize
152KB

Download
memory/2376-75-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2656-78-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2664-35-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/2664-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2848-133-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/2848-174-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/2884-65-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download