Analysis
-
max time kernel
112s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 16:27
Behavioral task
behavioral1
Sample
dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe
Resource
win10v2004-20241007-en
General
-
Target
dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe
-
Size
759KB
-
MD5
03edaa36e7b8d63c84bf12d88a6283c0
-
SHA1
3bc772b6e917545db2e876179f28908826f27b89
-
SHA256
dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5c
-
SHA512
8a234d2572942ac1093f6900402b3d7965177532819016b8a91ea639f928a37761c102871ae112f157e720c08706dd806775d141b8d26125b0868253faaaf886
-
SSDEEP
12288:WMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9eej:WnsJ39LyjbJkQFMhmC+6GD9X
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 4956 ._cache_dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe 3916 Synaptics.exe 3540 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3452 4956 WerFault.exe 83 3588 3540 WerFault.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1632 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4764 wrote to memory of 4956 4764 dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe 83 PID 4764 wrote to memory of 4956 4764 dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe 83 PID 4764 wrote to memory of 4956 4764 dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe 83 PID 4764 wrote to memory of 3916 4764 dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe 85 PID 4764 wrote to memory of 3916 4764 dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe 85 PID 4764 wrote to memory of 3916 4764 dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe 85 PID 3916 wrote to memory of 3540 3916 Synaptics.exe 88 PID 3916 wrote to memory of 3540 3916 Synaptics.exe 88 PID 3916 wrote to memory of 3540 3916 Synaptics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe"C:\Users\Admin\AppData\Local\Temp\dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\._cache_dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe"C:\Users\Admin\AppData\Local\Temp\._cache_dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 8803⤵
- Program crash
PID:3452
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 8484⤵
- Program crash
PID:3588
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4956 -ip 49561⤵PID:4960
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3540 -ip 35401⤵PID:4116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
759KB
MD503edaa36e7b8d63c84bf12d88a6283c0
SHA13bc772b6e917545db2e876179f28908826f27b89
SHA256dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5c
SHA5128a234d2572942ac1093f6900402b3d7965177532819016b8a91ea639f928a37761c102871ae112f157e720c08706dd806775d141b8d26125b0868253faaaf886
-
C:\Users\Admin\AppData\Local\Temp\._cache_dde0ed5aeb4a5209ff8f7cfa2134d7541ca0b376447b38ad96c4e0e1bd2a9c5cN.exe
Filesize6KB
MD5ae06fd4cde97f7bfa287ee3a3760ca18
SHA15eb1bf23168ba22e04d051c64f76d6ac8ce2c2b9
SHA25644603ac8b9cfa164c77c3d97cab92f890b466514d14e94b516a6b903859d0f41
SHA512629d7bfc1c5c5ede975dde3978fcde8497e21d09b7ab6006e96ec044bf8fc4590c63c38653253c7cc7242ecb4067efd134f7bfd593d2747eddcad802dd37d703
-
Filesize
22KB
MD542ad32a18f9768be8b8a05b45dcb3ecb
SHA1e45d1399c29e7bb361a5e37ac958b400674cabb6
SHA2566e1763597cca21cf73adb39e36b4762d30c9351769c0951c18cea79884c36f0b
SHA512f32481b4d57e41e13f27b4509d0cdc6201e041f9af86cde89d936befa3e25d9052e9ac710163e190c8c28afdb1df1fdbcb9bd0b94d28141916e4e6538c74060c
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04