Analysis
-
max time kernel
112s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 13:13
Behavioral task
behavioral1
Sample
eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe
Resource
win10v2004-20241007-en
General
-
Target
eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe
-
Size
1.5MB
-
MD5
23176611a7592536eb073ac16573e440
-
SHA1
15b9e3ddaaaff9a56086c4e0a2ad7c0afe08f47c
-
SHA256
eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfd
-
SHA512
78163f8ff5986dcc5afdb6db2901c01fd7a8de091b1c104abcec379d14ea259e4c2fdf0ff3f714119a171d8f9a26b56c00a68d95761b877a41dfac375aefa318
-
SSDEEP
24576:insJ39LyjbJkQFMhmC+6GD9bUGJBSZttoGQljjfuCy9wQ6an7:insHyjtk2MYC5GDQoGQljL+
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 5056 ._cache_eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe 3084 Synaptics.exe 3332 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 8 pastebin.com 10 pastebin.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4516 5056 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1100 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5056 ._cache_eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe Token: SeDebugPrivilege 3332 ._cache_Synaptics.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1100 EXCEL.EXE 1100 EXCEL.EXE 1100 EXCEL.EXE 1100 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 552 wrote to memory of 5056 552 eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe 83 PID 552 wrote to memory of 5056 552 eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe 83 PID 552 wrote to memory of 5056 552 eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe 83 PID 552 wrote to memory of 3084 552 eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe 85 PID 552 wrote to memory of 3084 552 eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe 85 PID 552 wrote to memory of 3084 552 eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe 85 PID 3084 wrote to memory of 3332 3084 Synaptics.exe 86 PID 3084 wrote to memory of 3332 3084 Synaptics.exe 86 PID 3084 wrote to memory of 3332 3084 Synaptics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe"C:\Users\Admin\AppData\Local\Temp\eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\._cache_eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe"C:\Users\Admin\AppData\Local\Temp\._cache_eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 17083⤵
- Program crash
PID:4516
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3332
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5056 -ip 50561⤵PID:1916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD523176611a7592536eb073ac16573e440
SHA115b9e3ddaaaff9a56086c4e0a2ad7c0afe08f47c
SHA256eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfd
SHA51278163f8ff5986dcc5afdb6db2901c01fd7a8de091b1c104abcec379d14ea259e4c2fdf0ff3f714119a171d8f9a26b56c00a68d95761b877a41dfac375aefa318
-
C:\Users\Admin\AppData\Local\Temp\._cache_eae910b312db72d424616f4bfb799092a4e0b0a5a44b23100fbe1daba0ac7bfdN.exe
Filesize796KB
MD53af8103c6e2ba160987b5b4e87b231d2
SHA1b65c5f0351e1689b7d1e1e68e2e443176831378c
SHA25666cd57c5830bb579d017a0a7b4924e03a4177ba40c82045100da383ea2144946
SHA512fc7c3e1326fbaee32066e567384c18abf7e85cbfa489a48fa25e0bcfb79d8f3f8f7e4e9a61e6c6f2a1203e15682fd35ab8c3d4988298b837f2854b7c7791341a
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04