xred | 67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
Size

1.6MB
MD5

1585cb2963dceb92fbcf6c4c057e191e
SHA1

2063f45e9c82553bbc41cb4bc8e10b2d06d701c9
SHA256

67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b
SHA512

88475b49d4299519b978711b16e0ea40579a3b671eb898d3d3f8391fbc2de55665bc0a978a20578a4c83f6bf3894a857e4013f34b0e2e4db6de404f66ef9ce47
SSDEEP

24576:gnsJ39LyjbJkQFMhmC+6GD9YhloDX0XOf4tHzneKlVLaqueI0psAzrcP39h:gnsHyjtk2MYC5GDyhloJfaelV6skAfX

Score

10^/10

xred backdoor discovery persistence upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WLJOQW.lnk	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe

Executes dropped EXE 5 IoCs

pid	Process
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2076	Synaptics.exe
2552	._cache_Synaptics.exe
236	DELPQB.exe
316	DELPQB.exe

Loads dropped DLL 6 IoCs

pid	Process
2012	67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2012	67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2012	67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2076	Synaptics.exe
2076	Synaptics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\WLJOQW = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\DELPQB.exe\""	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe

AutoIT Executable 10 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2552-47-0x0000000000C40000-0x0000000000E30000-memory.dmp	autoit_exe
behavioral1/memory/2552-50-0x0000000000C40000-0x0000000000E30000-memory.dmp	autoit_exe
behavioral1/memory/2284-128-0x0000000000D30000-0x0000000000F20000-memory.dmp	autoit_exe
behavioral1/memory/2284-130-0x0000000000D30000-0x0000000000F20000-memory.dmp	autoit_exe
behavioral1/memory/2284-137-0x0000000000D30000-0x0000000000F20000-memory.dmp	autoit_exe
behavioral1/memory/236-144-0x0000000001060000-0x0000000001250000-memory.dmp	autoit_exe
behavioral1/memory/2284-175-0x0000000000D30000-0x0000000000F20000-memory.dmp	autoit_exe
behavioral1/memory/2284-181-0x0000000000D30000-0x0000000000F20000-memory.dmp	autoit_exe
behavioral1/memory/316-187-0x00000000012D0000-0x00000000014C0000-memory.dmp	autoit_exe
behavioral1/memory/2284-190-0x0000000000D30000-0x0000000000F20000-memory.dmp	autoit_exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000014b4f-4.dat	upx
behavioral1/memory/2284-18-0x0000000000D30000-0x0000000000F20000-memory.dmp	upx
behavioral1/memory/2012-11-0x00000000056D0000-0x00000000058C0000-memory.dmp	upx
behavioral1/memory/2552-47-0x0000000000C40000-0x0000000000E30000-memory.dmp	upx
behavioral1/memory/2552-50-0x0000000000C40000-0x0000000000E30000-memory.dmp	upx
behavioral1/memory/2284-128-0x0000000000D30000-0x0000000000F20000-memory.dmp	upx
behavioral1/memory/2284-130-0x0000000000D30000-0x0000000000F20000-memory.dmp	upx
behavioral1/memory/2284-137-0x0000000000D30000-0x0000000000F20000-memory.dmp	upx
behavioral1/memory/236-143-0x0000000001060000-0x0000000001250000-memory.dmp	upx
behavioral1/memory/236-144-0x0000000001060000-0x0000000001250000-memory.dmp	upx
behavioral1/memory/2284-175-0x0000000000D30000-0x0000000000F20000-memory.dmp	upx
behavioral1/memory/2284-181-0x0000000000D30000-0x0000000000F20000-memory.dmp	upx
behavioral1/memory/316-186-0x00000000012D0000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/316-187-0x00000000012D0000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/2284-190-0x0000000000D30000-0x0000000000F20000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSCript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DELPQB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DELPQB.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2720	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1548	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1548	EXCEL.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2284	2012	67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	31
PID 2012 wrote to memory of 2284	2012	67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	31
PID 2012 wrote to memory of 2284	2012	67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	31
PID 2012 wrote to memory of 2284	2012	67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	31
PID 2012 wrote to memory of 2076	2012	67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	32
PID 2012 wrote to memory of 2076	2012	67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	32
PID 2012 wrote to memory of 2076	2012	67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	32
PID 2012 wrote to memory of 2076	2012	67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	32
PID 2284 wrote to memory of 2556	2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	33
PID 2284 wrote to memory of 2556	2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	33
PID 2284 wrote to memory of 2556	2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	33
PID 2284 wrote to memory of 2556	2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	33
PID 2284 wrote to memory of 2688	2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	35
PID 2284 wrote to memory of 2688	2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	35
PID 2284 wrote to memory of 2688	2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	35
PID 2284 wrote to memory of 2688	2284	._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe	35
PID 2556 wrote to memory of 2720	2556	cmd.exe	36
PID 2556 wrote to memory of 2720	2556	cmd.exe	36
PID 2556 wrote to memory of 2720	2556	cmd.exe	36
PID 2556 wrote to memory of 2720	2556	cmd.exe	36
PID 2076 wrote to memory of 2552	2076	Synaptics.exe	37
PID 2076 wrote to memory of 2552	2076	Synaptics.exe	37
PID 2076 wrote to memory of 2552	2076	Synaptics.exe	37
PID 2076 wrote to memory of 2552	2076	Synaptics.exe	37
PID 2276 wrote to memory of 236	2276	taskeng.exe	43
PID 2276 wrote to memory of 236	2276	taskeng.exe	43
PID 2276 wrote to memory of 236	2276	taskeng.exe	43
PID 2276 wrote to memory of 236	2276	taskeng.exe	43
PID 2276 wrote to memory of 316	2276	taskeng.exe	45
PID 2276 wrote to memory of 316	2276	taskeng.exe	45
PID 2276 wrote to memory of 316	2276	taskeng.exe	45
PID 2276 wrote to memory of 316	2276	taskeng.exe	45

C:\Users\Admin\AppData\Local\Temp\67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
"C:\Users\Admin\AppData\Local\Temp\67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn WLJOQW.exe /tr C:\Users\Admin\AppData\Roaming\Windata\DELPQB.exe /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn WLJOQW.exe /tr C:\Users\Admin\AppData\Roaming\Windata\DELPQB.exe /sc minute /mo 1
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2720
- - C:\Windows\SysWOW64\WSCript.exe
    WSCript C:\Users\Admin\AppData\Local\Temp\WLJOQW.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2688
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2552

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1548

C:\Windows\system32\taskeng.exe
taskeng.exe {CFC7BD8D-7CD2-4DDB-910A-91DD3104FF4B} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Roaming\Windata\DELPQB.exe
  C:\Users\Admin\AppData\Roaming\Windata\DELPQB.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:236
- C:\Users\Admin\AppData\Roaming\Windata\DELPQB.exe
  C:\Users\Admin\AppData\Roaming\Windata\DELPQB.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.6MB

MD5
1585cb2963dceb92fbcf6c4c057e191e

SHA1
2063f45e9c82553bbc41cb4bc8e10b2d06d701c9

SHA256
67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b

SHA512
88475b49d4299519b978711b16e0ea40579a3b671eb898d3d3f8391fbc2de55665bc0a978a20578a4c83f6bf3894a857e4013f34b0e2e4db6de404f66ef9ce47

Download Submit
C:\Users\Admin\AppData\Local\Temp\WLJOQW.vbs

Filesize
964B

MD5
1fd570ecb5e887b36ecd00b266bf20e7

SHA1
eb722165de399367dc99cd3518231fdfa40a0598

SHA256
d73308adf382bcd5bb8c692ee8628de2b933a108f3e538aeb7bb41abfba0c3c6

SHA512
cd4ee13c9a2f6cef6144174e512721284f15e70401f53187c3c1987e585a977537f7a05a62b1c5fee826530e1f4ba66454f063a500060c4bafb073087c6d23df

Download Submit
C:\Users\Admin\AppData\Local\Temp\ryBHjk8g.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\ryBHjk8g.xlsm

Filesize
24KB

MD5
78dbeb07dc7dd3afbf732d13a44d76b6

SHA1
99b66cbb87d7fd79097146c4b1f8dc2503313488

SHA256
d567568c69ccf694bb9cc7ffb328c0e709a5213bcb4b95da0374706d08dd5591

SHA512
77efe48c7f57669c58f4d217cc51d62feb1f8113030fbe8a95bbd4476ebcf9f3c87efcef5633733a549f5492e73b647cd67883aa64cc74a04d5c1f05db3d8f74

Download Submit
C:\Users\Admin\AppData\Local\Temp\ryBHjk8g.xlsm

Filesize
31KB

MD5
9d11e8d4f48aa16a6ffa29932755cc8d

SHA1
94ce6839c664c953abf397221087c17e8ffa2a82

SHA256
d4f385b1345f725fc2e05519e847f4ce54c456a25bf4c334e4cade70cb8f5775

SHA512
0e8f36d7525e985987f8a28e0dce1c045a0a126c5dc75f4e18903f8c1d414f196c8045d9d802569b702ca1e3f78349c58fa63933b8ed8135c1984eaa9ce0b4c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ryBHjk8g.xlsm

Filesize
26KB

MD5
eda1649a2d43848adacbac25787eb987

SHA1
5f0221bec86b88d812ea004f8b2d1d1337c39900

SHA256
69172a68a634162d01ca967339b90dd91d90178ca214ca2e51226c019f98ba55

SHA512
64c0b6498b0058a93bd5b909e132ece0089528db920ff5ebffbf0cfd608992e3bcc2cfdf8eb5427e1ceb246c3ac0dec23791f72fdc9a3621007065b6b389bb74

Download Submit
C:\Users\Admin\AppData\Local\Temp\ryBHjk8g.xlsm

Filesize
26KB

MD5
8d8f06f0164d72910619c3dfa63a522b

SHA1
769cab91c8997b891b5d108b06ca5f3ca04f6406

SHA256
ed6f1d4f6858fc9c26387c255440d4315c93273a4a33eb9899c456f204283895

SHA512
f15444996a3f23231cc3aec3ae57f10b0c467042ed02f97807ac40d004fb2a35ffcb1c6923c0af30339632abf100639e633565aafe4db7c8f9b1a113299bda5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~$ryBHjk8g.xlsm

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_67d5fc80b6bf87eb6bc3d505b0102cfdf8e8727d3da004d982467ab08ded7f0b.exe

Filesize
898KB

MD5
66a4951d384b55633ab61add85514f07

SHA1
bbf7a65a664bb2b8001576bf670a8381aad3a185

SHA256
6068b17cf1c362bfe7736e0b192c362735a040a68a6d41eb8ccdd8be242ca191

SHA512
d4dc27627baa28e79ae6dbd375a08c2afb5d47f43dd1c15e41a5033ac3c95bad018ebe5087dafad62fe2266fa7b69599ec2bed92da521208aab5011f854c7123

Download Submit
memory/236-144-0x0000000001060000-0x0000000001250000-memory.dmp

Filesize
1.9MB

Download
memory/236-143-0x0000000001060000-0x0000000001250000-memory.dmp

Filesize
1.9MB

Download
memory/316-187-0x00000000012D0000-0x00000000014C0000-memory.dmp

Filesize
1.9MB

Download
memory/316-186-0x00000000012D0000-0x00000000014C0000-memory.dmp

Filesize
1.9MB

Download
memory/1548-51-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1548-127-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2012-11-0x00000000056D0000-0x00000000058C0000-memory.dmp

Filesize
1.9MB

Download
memory/2012-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2012-29-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2076-45-0x0000000005550000-0x0000000005740000-memory.dmp

Filesize
1.9MB

Download
memory/2076-132-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2076-176-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2076-131-0x0000000005550000-0x0000000005740000-memory.dmp

Filesize
1.9MB

Download
memory/2076-134-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/2284-137-0x0000000000D30000-0x0000000000F20000-memory.dmp

Filesize
1.9MB

Download
memory/2284-130-0x0000000000D30000-0x0000000000F20000-memory.dmp

Filesize
1.9MB

Download
memory/2284-128-0x0000000000D30000-0x0000000000F20000-memory.dmp

Filesize
1.9MB

Download
memory/2284-175-0x0000000000D30000-0x0000000000F20000-memory.dmp

Filesize
1.9MB

Download
memory/2284-129-0x00000000007E0000-0x00000000007F0000-memory.dmp

Filesize
64KB

Download
memory/2284-181-0x0000000000D30000-0x0000000000F20000-memory.dmp

Filesize
1.9MB

Download
memory/2284-36-0x00000000007E0000-0x00000000007F0000-memory.dmp

Filesize
64KB

Download
memory/2284-18-0x0000000000D30000-0x0000000000F20000-memory.dmp

Filesize
1.9MB

Download
memory/2284-190-0x0000000000D30000-0x0000000000F20000-memory.dmp

Filesize
1.9MB

Download
memory/2552-50-0x0000000000C40000-0x0000000000E30000-memory.dmp

Filesize
1.9MB

Download
memory/2552-47-0x0000000000C40000-0x0000000000E30000-memory.dmp

Filesize
1.9MB

Download