Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 04:28
Behavioral task
behavioral1
Sample
f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe
Resource
win10v2004-20241007-en
General
-
Target
f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe
-
Size
773KB
-
MD5
5dce71e1f55a1fc395ee1638de290165
-
SHA1
1dfd5ff0c4edb7d03fd242c37bd5d0c4b4caa9fa
-
SHA256
f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f
-
SHA512
f097a9ffcf26edd345426268efb11a34a8e8da2328653ec26b528ceba4d5cd6672175eefa43d03fa65a9cb2d0cd156324e13f33b912561305e8031066c407f86
-
SSDEEP
12288:qMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V96XUn:qnsJ39LyjbJkQFMhmC+6GD9gw
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
pid Process 2520 ._cache_f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 2460 Synaptics.exe 2752 ._cache_Synaptics.exe -
Loads dropped DLL 5 IoCs
pid Process 1868 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 1868 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 1868 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 2460 Synaptics.exe 2460 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2808 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2808 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2520 1868 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 30 PID 1868 wrote to memory of 2520 1868 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 30 PID 1868 wrote to memory of 2520 1868 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 30 PID 1868 wrote to memory of 2520 1868 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 30 PID 1868 wrote to memory of 2460 1868 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 32 PID 1868 wrote to memory of 2460 1868 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 32 PID 1868 wrote to memory of 2460 1868 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 32 PID 1868 wrote to memory of 2460 1868 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 32 PID 2460 wrote to memory of 2752 2460 Synaptics.exe 33 PID 2460 wrote to memory of 2752 2460 Synaptics.exe 33 PID 2460 wrote to memory of 2752 2460 Synaptics.exe 33 PID 2460 wrote to memory of 2752 2460 Synaptics.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe"C:\Users\Admin\AppData\Local\Temp\f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\._cache_f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe"C:\Users\Admin\AppData\Local\Temp\._cache_f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe"2⤵
- Executes dropped EXE
PID:2520
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:2752
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
773KB
MD55dce71e1f55a1fc395ee1638de290165
SHA11dfd5ff0c4edb7d03fd242c37bd5d0c4b4caa9fa
SHA256f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f
SHA512f097a9ffcf26edd345426268efb11a34a8e8da2328653ec26b528ceba4d5cd6672175eefa43d03fa65a9cb2d0cd156324e13f33b912561305e8031066c407f86
-
Filesize
26KB
MD52c67e9f49ffbcd650d11fa3a4de32b67
SHA14db5e4006b20201957c5ff1c433f1ded3deed57a
SHA256c496f27fa7c83421fa23c2e57c7c6cc232d5212455a3c6560842593ab2462962
SHA512da777dc883ed90e5cbba6df13e9b8833be45cb2e40ea327c5a3055e7bd85b5335c34d38fcfa03f2fa56bdd99c9e9f33e2ac7c2da12f004959017186e6895137c
-
Filesize
25KB
MD5780fa45d67c8c262754dd4ebe687156b
SHA1001aafc2d96ba2ba32cf967b7b4cda1e6f7d92ea
SHA256a96731c0ff49b5d0f98346c89877c3ab3af402412e0a9db04aede49733343a63
SHA5128f5a05155adc106627d6ee01d5d7c786bf94274e71e12a590c91a5ad6cb58c3b134dfd30eefa3a36d1651a7031d32fffa9f8345ee424aec8f9311e8614d34b0d
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
23KB
MD5fc05cfe62fba5e8f92f6985e3ff70a24
SHA17bb98be83fdcbd010793dd7583dc2be2af4cd453
SHA25607375f009915b26e4c4bcb6581eecbf34a85e158486d19114c710311f8b64e12
SHA5128b57fb22e55692b4c861c3b1bf88b32750586bc5290bc2d4ed9395d1a9425867915ea49343595ba5b5ea54531553f723269d3a1e1fdb210b54d61b62ee93b3bc
-
Filesize
26KB
MD54ebddb32229d1768b757d64534d2f89e
SHA194f0c447c0467c539b507fff97726c56e6aaf8e3
SHA2568f8acc37d119399a6b9496ef805f7ef73b99ccfa7851136d81f35c440ad186e2
SHA5129c685a067e35defa95315575ed6b2e489c8ffa23c13674a4d4302384e95687e930ac6677eee5e195413af30cae61498d80c19d2c7ac5d30776bade7502899278
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
\Users\Admin\AppData\Local\Temp\._cache_f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe
Filesize19KB
MD5fbf8449c9f6902b41847e6f7b6489d2a
SHA193a6cef57f262b22a82bc16dd9018e9ec8bf618e
SHA2566da2a772f8ff595c0fa8d3faf9f1e81751d6e1871f452c343e828a0c78ea55a2
SHA512e5ded8daa5549fad0cd40b7f9360874ec2987b7b346a9d48493d10a05feed71c36c59c066a8b9e7c9235a2db6b3da2e3e9d47dcd87cf8ccc2e79859b43bd2d62