Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 04:40
Behavioral task
behavioral1
Sample
f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe
Resource
win10v2004-20241007-en
General
-
Target
f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe
-
Size
773KB
-
MD5
5dce71e1f55a1fc395ee1638de290165
-
SHA1
1dfd5ff0c4edb7d03fd242c37bd5d0c4b4caa9fa
-
SHA256
f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f
-
SHA512
f097a9ffcf26edd345426268efb11a34a8e8da2328653ec26b528ceba4d5cd6672175eefa43d03fa65a9cb2d0cd156324e13f33b912561305e8031066c407f86
-
SSDEEP
12288:qMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V96XUn:qnsJ39LyjbJkQFMhmC+6GD9gw
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
resource behavioral1/files/0x00070000000171a8-83.dat -
Executes dropped EXE 3 IoCs
pid Process 2396 ._cache_f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 2472 Synaptics.exe 2208 ._cache_Synaptics.exe -
Loads dropped DLL 5 IoCs
pid Process 2504 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 2504 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 2504 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 2472 Synaptics.exe 2472 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2644 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2644 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2396 2504 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 30 PID 2504 wrote to memory of 2396 2504 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 30 PID 2504 wrote to memory of 2396 2504 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 30 PID 2504 wrote to memory of 2396 2504 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 30 PID 2504 wrote to memory of 2472 2504 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 32 PID 2504 wrote to memory of 2472 2504 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 32 PID 2504 wrote to memory of 2472 2504 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 32 PID 2504 wrote to memory of 2472 2504 f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe 32 PID 2472 wrote to memory of 2208 2472 Synaptics.exe 33 PID 2472 wrote to memory of 2208 2472 Synaptics.exe 33 PID 2472 wrote to memory of 2208 2472 Synaptics.exe 33 PID 2472 wrote to memory of 2208 2472 Synaptics.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe"C:\Users\Admin\AppData\Local\Temp\f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\._cache_f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe"C:\Users\Admin\AppData\Local\Temp\._cache_f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe"2⤵
- Executes dropped EXE
PID:2396
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:2208
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
773KB
MD55dce71e1f55a1fc395ee1638de290165
SHA11dfd5ff0c4edb7d03fd242c37bd5d0c4b4caa9fa
SHA256f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f
SHA512f097a9ffcf26edd345426268efb11a34a8e8da2328653ec26b528ceba4d5cd6672175eefa43d03fa65a9cb2d0cd156324e13f33b912561305e8031066c407f86
-
C:\Users\Admin\AppData\Local\Temp\._cache_f029300764ce133a035f1e491f7845a03819848c60f44d1199f400c97d47d78f.exe
Filesize19KB
MD5fbf8449c9f6902b41847e6f7b6489d2a
SHA193a6cef57f262b22a82bc16dd9018e9ec8bf618e
SHA2566da2a772f8ff595c0fa8d3faf9f1e81751d6e1871f452c343e828a0c78ea55a2
SHA512e5ded8daa5549fad0cd40b7f9360874ec2987b7b346a9d48493d10a05feed71c36c59c066a8b9e7c9235a2db6b3da2e3e9d47dcd87cf8ccc2e79859b43bd2d62
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
24KB
MD5088bb0f16410279053a6e3ea92aa25a8
SHA14d3179e43baaf1ec5e347181115769aa9609e9a6
SHA25696445051eee5da7a919c958fddab9287a92585b821f42319712be5e7a11eb02a
SHA512b8124138b767fdb80b86fbcddbf048078c4246612221312d710ddb6dfb4e4a256e6625059d239fbba1f869e63406232a86bdfdea717c96a3b3cfb28b5971284c
-
Filesize
24KB
MD590bf3fb1b138665ebcc9ce2aa0d9a973
SHA1613a76fa3e94d0c3260269f999839bede57059b1
SHA25634532f5bbb3384f0195651bc310ddf91225885070ba0c4587cb78364d53bfd2a
SHA5121798a19c33cb827a8354a862daf6e3bc4d6d80974e0085535b7c0b7c0ed01f07e7d9c5d22864c3258a5b87d89a611c473db5de52458a1bbf02410b28008d7514
-
Filesize
22KB
MD5be257dfcc43d84791d857429b4fb2c4e
SHA19512bef2bf908c41b4ce26015db0a2d53cdf2b45
SHA2561c5a17415fc29d75c732bedbfed3074d61a382cb09d8071f431ed9bf92da2f16
SHA5129b1bf20abc3c8a5ff86d097884ce146869f39ae9e8912f52aa3218cded111df347c4dc9cf4214b694f3abe6c33e1719c068774314ef3f54abf4ae7529fd3cac8