Analysis
-
max time kernel
111s -
max time network
107s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-12-2024 03:15
Behavioral task
behavioral1
Sample
20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe
Resource
win10v2004-20241007-en
General
-
Target
20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe
-
Size
2.1MB
-
MD5
e4f3f8af6aa099b238cd2a8166983ed8
-
SHA1
3e48cd17ba64bd903014c37a822ffe65006c1360
-
SHA256
20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13
-
SHA512
00efd5c46be401ca6857ce8743efa12453772e22172b3cbe9e32dd77566abb5bc96d9a4f699f17d69e59a25c3f9a24de6a42774997fb06a2acfef0815a5ecb4c
-
SSDEEP
49152:UnsHyjtk2MYC5GDaOmT4saDtdEipAoSLeGViNZ9HBZerzCQ:Unsmtk2aBNODLrAoXTNBZeXz
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
pid Process 2408 ._cache_20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 2152 Synaptics.exe 2156 ._cache_Synaptics.exe -
Loads dropped DLL 7 IoCs
pid Process 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 2152 Synaptics.exe 2152 Synaptics.exe 2152 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2628 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2628 EXCEL.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2408 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 31 PID 2320 wrote to memory of 2408 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 31 PID 2320 wrote to memory of 2408 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 31 PID 2320 wrote to memory of 2408 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 31 PID 2320 wrote to memory of 2408 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 31 PID 2320 wrote to memory of 2408 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 31 PID 2320 wrote to memory of 2408 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 31 PID 2320 wrote to memory of 2152 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 32 PID 2320 wrote to memory of 2152 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 32 PID 2320 wrote to memory of 2152 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 32 PID 2320 wrote to memory of 2152 2320 20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe 32 PID 2152 wrote to memory of 2156 2152 Synaptics.exe 33 PID 2152 wrote to memory of 2156 2152 Synaptics.exe 33 PID 2152 wrote to memory of 2156 2152 Synaptics.exe 33 PID 2152 wrote to memory of 2156 2152 Synaptics.exe 33 PID 2152 wrote to memory of 2156 2152 Synaptics.exe 33 PID 2152 wrote to memory of 2156 2152 Synaptics.exe 33 PID 2152 wrote to memory of 2156 2152 Synaptics.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe"C:\Users\Admin\AppData\Local\Temp\20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\._cache_20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe"C:\Users\Admin\AppData\Local\Temp\._cache_20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2156
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5e4f3f8af6aa099b238cd2a8166983ed8
SHA13e48cd17ba64bd903014c37a822ffe65006c1360
SHA25620bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13
SHA51200efd5c46be401ca6857ce8743efa12453772e22172b3cbe9e32dd77566abb5bc96d9a4f699f17d69e59a25c3f9a24de6a42774997fb06a2acfef0815a5ecb4c
-
Filesize
24KB
MD594cca6c93cfb22d04fdaf6238d2cd82f
SHA1b99178cf8807692c591d6d4bc9c03577cb9fd8b5
SHA2560fd78ae1ebdf936beefe0b01d4871e7d414c831d4480f04d5b6150da315bceae
SHA5124ab94bf5da7fcb404c5c4ca29c4fcf9cb91413aeccf7fa4dcb0b2c76cffba2d5f9cfcce9ef0bd5d86bbd6d4ed16aceb8519160b827f45cf37fb3f1aaf51a8ded
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
\Users\Admin\AppData\Local\Temp\._cache_20bd29ceb52c6773374dc4e9981b0296b735205c870678932a040f207356fb13.exe
Filesize1.4MB
MD537af598f318c9ea474545c9d91156398
SHA195c383b1837ec0e41f3b9f179fc94b88e8d9009a
SHA256cb2f3166860b81859efaeb95aece2fe39a003e3497bdfd0c2135a78e446ef436
SHA5129d444afaa8b5ede89c53321cb97deab96b04ec91de2087df004801e94338eb9707351bedfefd1e85f02188126c492d88520a662362012c15cf60ba97985c3c69