xred | b3763fd28aaaed4351ed92096131e9fabd1e00b34b87bb2312efd611ad66a4d4

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2024, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

EMVReaderWriterSoftware.exe
Size

1.7MB
MD5

b419b88ad4736f6e14fae96431188b78
SHA1

5a805150faca002946601b12fe48d83f569d1003
SHA256

b3763fd28aaaed4351ed92096131e9fabd1e00b34b87bb2312efd611ad66a4d4
SHA512

7a959f1f3ad3c083662c6ab505757b8f8e9de4ec51187ef207bd34c68903dcc649b871ca662ff71ebcf9d176e016e9da5173ff9dbd0ca8824671678bf5bfd974
SSDEEP

24576:QnsJ39LyjbJkQFMhmC+6GD94n+PB8P/H9jXKZP57nP0eWcjGKZplchPT2IXw7ChL:QnsHyjtk2MYC5GDinl2J+6kw7A

Score

10^/10

xred backdoor discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4004	netsh.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	tmp2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	SynTPHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	EMVReaderWriterSoftware.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	._cache_EMVReaderWriterSoftware.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	tmp2.exe

Executes dropped EXE 14 IoCs

pid	Process
1948	._cache_EMVReaderWriterSoftware.exe
4352	Synaptics.exe
2980	SynTPHelper.exe
2776	EMV Reader Writer Software V8.exe
1788	._cache_Synaptics.exe
4524	tmp1.jpg
3044	SynTPHelper.exe
4748	EMV Reader Writer Software V8.exe
3632	tmp1.jpg
3976	tmp2.exe
4268	tmp2.exe
3932	emv.exe
4476	emv.exe
548	SynTPHelper.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\emv.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\emv.exe"	tmp2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\emv.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\emv.exe"	tmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	EMVReaderWriterSoftware.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SynTPHelper.exe	SynTPHelper.exe
File opened for modification	C:\Windows\SynTPHelper.exe	SynTPHelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_EMVReaderWriterSoftware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMV Reader Writer Software V8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1.jpg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SynTPHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMV Reader Writer Software V8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMVReaderWriterSoftware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1.jpg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SynTPHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SynTPHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x000c000000023b1f-5.dat	nsis_installer_1
behavioral2/files/0x000c000000023b1f-5.dat	nsis_installer_2
behavioral2/files/0x000a000000023b74-39.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	EMVReaderWriterSoftware.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1016	EXCEL.EXE
3932	emv.exe
4476	emv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe
548	SynTPHelper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
548	SynTPHelper.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	548	SynTPHelper.exe
Token: 33	548	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	548	SynTPHelper.exe
Token: 33	548	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	548	SynTPHelper.exe
Token: 33	548	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	548	SynTPHelper.exe
Token: 33	548	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	548	SynTPHelper.exe
Token: 33	548	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	548	SynTPHelper.exe
Token: 33	548	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	548	SynTPHelper.exe
Token: 33	548	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	548	SynTPHelper.exe
Token: 33	548	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	548	SynTPHelper.exe
Token: 33	548	SynTPHelper.exe
Token: SeIncBasePriorityPrivilege	548	SynTPHelper.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1016	EXCEL.EXE
1016	EXCEL.EXE
1016	EXCEL.EXE
1016	EXCEL.EXE
1016	EXCEL.EXE
1016	EXCEL.EXE

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1948	4724	EMVReaderWriterSoftware.exe	83
PID 4724 wrote to memory of 1948	4724	EMVReaderWriterSoftware.exe	83
PID 4724 wrote to memory of 1948	4724	EMVReaderWriterSoftware.exe	83
PID 4724 wrote to memory of 4352	4724	EMVReaderWriterSoftware.exe	84
PID 4724 wrote to memory of 4352	4724	EMVReaderWriterSoftware.exe	84
PID 4724 wrote to memory of 4352	4724	EMVReaderWriterSoftware.exe	84
PID 1948 wrote to memory of 2980	1948	._cache_EMVReaderWriterSoftware.exe	85
PID 1948 wrote to memory of 2980	1948	._cache_EMVReaderWriterSoftware.exe	85
PID 1948 wrote to memory of 2980	1948	._cache_EMVReaderWriterSoftware.exe	85
PID 1948 wrote to memory of 2776	1948	._cache_EMVReaderWriterSoftware.exe	86
PID 1948 wrote to memory of 2776	1948	._cache_EMVReaderWriterSoftware.exe	86
PID 1948 wrote to memory of 2776	1948	._cache_EMVReaderWriterSoftware.exe	86
PID 2776 wrote to memory of 1940	2776	EMV Reader Writer Software V8.exe	87
PID 2776 wrote to memory of 1940	2776	EMV Reader Writer Software V8.exe	87
PID 2776 wrote to memory of 1940	2776	EMV Reader Writer Software V8.exe	87
PID 4352 wrote to memory of 1788	4352	Synaptics.exe	88
PID 4352 wrote to memory of 1788	4352	Synaptics.exe	88
PID 4352 wrote to memory of 1788	4352	Synaptics.exe	88
PID 1940 wrote to memory of 4524	1940	cmd.exe	91
PID 1940 wrote to memory of 4524	1940	cmd.exe	91
PID 1940 wrote to memory of 4524	1940	cmd.exe	91
PID 1788 wrote to memory of 3044	1788	._cache_Synaptics.exe	92
PID 1788 wrote to memory of 3044	1788	._cache_Synaptics.exe	92
PID 1788 wrote to memory of 3044	1788	._cache_Synaptics.exe	92
PID 1788 wrote to memory of 4748	1788	._cache_Synaptics.exe	93
PID 1788 wrote to memory of 4748	1788	._cache_Synaptics.exe	93
PID 1788 wrote to memory of 4748	1788	._cache_Synaptics.exe	93
PID 4748 wrote to memory of 3212	4748	EMV Reader Writer Software V8.exe	94
PID 4748 wrote to memory of 3212	4748	EMV Reader Writer Software V8.exe	94
PID 4748 wrote to memory of 3212	4748	EMV Reader Writer Software V8.exe	94
PID 2776 wrote to memory of 2504	2776	EMV Reader Writer Software V8.exe	96
PID 2776 wrote to memory of 2504	2776	EMV Reader Writer Software V8.exe	96
PID 2776 wrote to memory of 2504	2776	EMV Reader Writer Software V8.exe	96
PID 3212 wrote to memory of 3632	3212	cmd.exe	98
PID 3212 wrote to memory of 3632	3212	cmd.exe	98
PID 3212 wrote to memory of 3632	3212	cmd.exe	98
PID 4748 wrote to memory of 4404	4748	EMV Reader Writer Software V8.exe	99
PID 4748 wrote to memory of 4404	4748	EMV Reader Writer Software V8.exe	99
PID 4748 wrote to memory of 4404	4748	EMV Reader Writer Software V8.exe	99
PID 2504 wrote to memory of 3976	2504	cmd.exe	102
PID 2504 wrote to memory of 3976	2504	cmd.exe	102
PID 4404 wrote to memory of 4268	4404	cmd.exe	103
PID 4404 wrote to memory of 4268	4404	cmd.exe	103
PID 3976 wrote to memory of 4476	3976	tmp2.exe	104
PID 3976 wrote to memory of 4476	3976	tmp2.exe	104
PID 4268 wrote to memory of 3932	4268	tmp2.exe	105
PID 4268 wrote to memory of 3932	4268	tmp2.exe	105
PID 2980 wrote to memory of 548	2980	SynTPHelper.exe	123
PID 2980 wrote to memory of 548	2980	SynTPHelper.exe	123
PID 2980 wrote to memory of 548	2980	SynTPHelper.exe	123
PID 548 wrote to memory of 4004	548	SynTPHelper.exe	125
PID 548 wrote to memory of 4004	548	SynTPHelper.exe	125
PID 548 wrote to memory of 4004	548	SynTPHelper.exe	125

C:\Users\Admin\AppData\Local\Temp\EMVReaderWriterSoftware.exe
"C:\Users\Admin\AppData\Local\Temp\EMVReaderWriterSoftware.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Local\Temp\._cache_EMVReaderWriterSoftware.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_EMVReaderWriterSoftware.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\SynTPHelper.exe
      "C:\Windows\SynTPHelper.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:548
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\SynTPHelper.exe" "SynTPHelper.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4004
- - C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe
    "C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start %temp%\tmp1.jpg
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        
        C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4524
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start %temp%\tmp2.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Drpbx\emv.exe
        
        "C:\Users\Admin\AppData\Local\Drpbx\emv.exe" C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        
        PID:4476
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe
      "C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4748
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start %temp%\tmp1.jpg
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        
        C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3632
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start %temp%\tmp2.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Drpbx\emv.exe
        
        "C:\Users\Admin\AppData\Local\Drpbx\emv.exe" C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        7⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        
        PID:3932

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.7MB

MD5
b419b88ad4736f6e14fae96431188b78

SHA1
5a805150faca002946601b12fe48d83f569d1003

SHA256
b3763fd28aaaed4351ed92096131e9fabd1e00b34b87bb2312efd611ad66a4d4

SHA512
7a959f1f3ad3c083662c6ab505757b8f8e9de4ec51187ef207bd34c68903dcc649b871ca662ff71ebcf9d176e016e9da5173ff9dbd0ca8824671678bf5bfd974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\tmp2.exe.log

Filesize
430B

MD5
de04f2e81c0501dee6d2f449fb6f3885

SHA1
761a51e13b7958c5ec2e51de258428eedec0ae51

SHA256
92e5dd3c966959c5a39d98226668f5a2745e16db2ebf034eb5ee5d5f160ed8bb

SHA512
65e64986ec8b0681d72b7ec9590abe4ed443be492a4085dc4d9a6428e8f2e92d9bf46733f95bdf6de8e9efc97f035ab66d4400e83ac75d359dacecd7870161a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SynTPHelper.exe.log

Filesize
319B

MD5
824ba7b7eed8b900a98dd25129c4cd83

SHA1
54478770b2158000ef365591d42977cb854453a1

SHA256
d182dd648c92e41cd62dccc65f130c07f0a96c03b32f907c3d1218e9aa5bda03

SHA512
ae4f3a9673711ecb6cc5d06874c587341d5094803923b53b6e982278fa64549d7acf866de165e23750facd55da556b6794c0d32f129f4087529c73acd4ffb11e

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_EMVReaderWriterSoftware.exe

Filesize
942KB

MD5
35d2469a266ad4cf08ee723ca74b843d

SHA1
979527e8c77baab1d5d42d290c482a03543b2ea3

SHA256
9a696e11bcdd0d59577c43613d983daad607ea2fe0b2562f9359c23643cda18b

SHA512
f884e24ee775c64d42e2c914e27403c31087e13bccb9c89eb4814c1eca91d84744640f9e112851a12ea4a907b2d210f9c81b372ce7bd04a97037876ff701509a

Download Submit
C:\Users\Admin\AppData\Local\Temp\23975E00

Filesize
24KB

MD5
995cecd44911c32eb73de724f08abe24

SHA1
952da31c9eb8f3e1dedd2f9c7be3ba2d89645e44

SHA256
08f8e8c81333f60a1834ec53a61cf9a14ecd1556a988b3e40b8e6f58f9f4b517

SHA512
2d239488c5350496a2ae1dcc5051c26661266d91a4c7cdf94cf3d580d25aad5fa060e3fd048c75a1e5f908860a333edec82b99357f5d5001a2781e9d6c1bd3da

Download Submit
C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe

Filesize
560KB

MD5
a03920ec643f26a5d38676c953e6f4f6

SHA1
3756009fafeb360bc7f4b95654d027326688b8f0

SHA256
a1de7bc1d00660b7416e91442bcb89dcb8a05351eb22f03f89258d9077e69a80

SHA512
c472251c1a2e76100a6065d8e2b5fc42b5cf1fd85d4e31850b0f12806afb8e8b3c86f63c7ac2bee3f0a3add77412f03192f8c9fc494dc12e74295c7083f61156

Download Submit
C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe

Filesize
1.5MB

MD5
00291c15181baa184b62938cb519ba4c

SHA1
0691b2e7177466adf594352e27ebdfcd0d7aee90

SHA256
c4820b44454f5072937047af8fa53cabe7e21d3fdf0464581a70594b9f2a7f73

SHA512
f20a5d68b02f88fd94486e3158bf68af338eb6080b4aa75514c556cbbd3dda3044fc1bce1b5c3e37de8bb61277f60b0069a1480d8fd6412f4e020b0c3463cb80

Download Submit
C:\Users\Admin\AppData\Local\Temp\n1atxZcV.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1.jpg

Filesize
118KB

MD5
c9a3ccf95369f53cd448fac94ff4e3b8

SHA1
48131cd75821aad01ace71277206b7c6d7d4925c

SHA256
dc32698c13de42e87913c6d90939186a56ca4586e0397df52ed85e47443ceef4

SHA512
eeec3a8dd76cee4a1d774f7f34766742c6b92d833f8a92adb251cb618924935d3fbaf5c386b7c5291489ad805d3233dfd8b41aaafd73851aa9b410b45ff86e3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2.exe

Filesize
13KB

MD5
913157f29b94106f5b6db18d04eb3c41

SHA1
c0e08c5557e38f4705c4c614586de7becdfeafaa

SHA256
cc4cd74a7db7edd8a16da7ff6fccf491bf61cc19ac73aae5843c56821d09272f

SHA512
4f075ffea2887f5db4cd80c15736740afbee81f3b9148b7cc458bc36095daa59555767d4481668c6e9b91881dcf0107c36b495dde5d3ecce99aaf4cb490a413b

Download Submit
memory/1016-169-0x00007FFEA5820000-0x00007FFEA5830000-memory.dmp

Filesize
64KB

Download
memory/1016-161-0x00007FFEA7970000-0x00007FFEA7980000-memory.dmp

Filesize
64KB

Download
memory/1016-160-0x00007FFEA7970000-0x00007FFEA7980000-memory.dmp

Filesize
64KB

Download
memory/1016-158-0x00007FFEA7970000-0x00007FFEA7980000-memory.dmp

Filesize
64KB

Download
memory/1016-159-0x00007FFEA7970000-0x00007FFEA7980000-memory.dmp

Filesize
64KB

Download
memory/1016-174-0x00007FFEA5820000-0x00007FFEA5830000-memory.dmp

Filesize
64KB

Download
memory/1016-157-0x00007FFEA7970000-0x00007FFEA7980000-memory.dmp

Filesize
64KB

Download
memory/2776-181-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3632-173-0x0000000005E40000-0x00000000063E4000-memory.dmp

Filesize
5.6MB

Download
memory/3632-175-0x0000000005930000-0x00000000059C2000-memory.dmp

Filesize
584KB

Download
memory/3932-199-0x0000000001640000-0x0000000001648000-memory.dmp

Filesize
32KB

Download
memory/3976-183-0x000000001B560000-0x000000001BA2E000-memory.dmp

Filesize
4.8MB

Download
memory/4268-184-0x000000001BD60000-0x000000001BDFC000-memory.dmp

Filesize
624KB

Download
memory/4352-102-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/4352-248-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/4352-247-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/4352-292-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/4524-179-0x0000000005770000-0x000000000577A000-memory.dmp

Filesize
40KB

Download
memory/4524-180-0x00000000059B0000-0x0000000005A06000-memory.dmp

Filesize
344KB

Download
memory/4524-171-0x00000000056B0000-0x000000000574C000-memory.dmp

Filesize
624KB

Download
memory/4524-170-0x0000000000E00000-0x0000000000E26000-memory.dmp

Filesize
152KB

Download
memory/4724-0-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/4724-101-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/4748-191-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download