Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-12-2024 14:35
Behavioral task
behavioral1
Sample
9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
Resource
win10v2004-20241007-en
General
-
Target
9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
-
Size
4.9MB
-
MD5
31c87f5d5944f640a038bbac783d2fed
-
SHA1
d5c315906b21d3282546eb8d575bbd8627e5f2a0
-
SHA256
9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3
-
SHA512
86542ffc445909e619a4a1022e327cf657a54ebc1fa5610d283fdf17bab2d7ed3435f2bde60145dba462b5132e60e8edc2a8bff0837f7b4e4a9a086eaa962c38
-
SSDEEP
98304:8nsmtk2a3qn8jyKfnh00zrt2miokfKA9/iLIkZKIbqY1wu4a:SLx8j790miokb/iLIkAIh
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 3348 ._cache_9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe 2500 Synaptics.exe 224 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2248 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe 2500 Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1480 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2248 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe 2248 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe 2500 Synaptics.exe 2500 Synaptics.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2248 wrote to memory of 3348 2248 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe 83 PID 2248 wrote to memory of 3348 2248 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe 83 PID 2248 wrote to memory of 3348 2248 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe 83 PID 2248 wrote to memory of 2500 2248 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe 84 PID 2248 wrote to memory of 2500 2248 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe 84 PID 2248 wrote to memory of 2500 2248 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe 84 PID 2500 wrote to memory of 224 2500 Synaptics.exe 85 PID 2500 wrote to memory of 224 2500 Synaptics.exe 85 PID 2500 wrote to memory of 224 2500 Synaptics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe"C:\Users\Admin\AppData\Local\Temp\9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\._cache_9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe"C:\Users\Admin\AppData\Local\Temp\._cache_9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3348
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:224
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD531c87f5d5944f640a038bbac783d2fed
SHA1d5c315906b21d3282546eb8d575bbd8627e5f2a0
SHA2569c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3
SHA51286542ffc445909e619a4a1022e327cf657a54ebc1fa5610d283fdf17bab2d7ed3435f2bde60145dba462b5132e60e8edc2a8bff0837f7b4e4a9a086eaa962c38
-
C:\Users\Admin\AppData\Local\Temp\._cache_9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
Filesize182KB
MD5aceaf589902c4905f4d163f06cdb3213
SHA1889e6070de66e63ab00ea1f80233db907475e61e
SHA2569d6b6119d03a42674ecbda7dd6509b25443605330f7c9e5ce77e4e2e0f5a0d16
SHA51247ad71b73d4dbf2417828459ccea342a36aa03f08cffeae99de1b4a6698121bce94628bffb49cb749d6547e3ed740b4a2945b4a52f6bb067e6a78bff1b3470cd
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
21KB
MD582059b71e15383b319bb7b78e0fa2e07
SHA1b86bdad70072d793d395a54772900783b48a5890
SHA25682d4520608e3beb1647142fba6ae9868b84e7741c29226502b1de5c07e55fb11
SHA5120cd085bbb9418228120282569d68dde9096d525eb2f6df55549cbf9f42ceb1fdd92ecbda1bd83169c3d2b8f635aa7d19de65944bc89903cdebfb20b2d9d050c5