xred | c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
31/12/2024, 02:51 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
Size

1.6MB
MD5

71386f37f17778126296ca734975db6d
SHA1

353818dcd74d06565fc0e8ac4416e594d29ecd0b
SHA256

c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae
SHA512

e5e0d87f91611bccfea16222c9afb7ac7b949f1762244ced01f9d8a78e2c992cfe8c1faaf1391f4cf107604a0e9f7a64fa4adda1c339d8dc85b27e7be610b83c
SSDEEP

49152:gnsHyjtk2MYC5GD8hloJfCAh9RMUBrNUFqtBZlO:gnsmtk2a1hlPERBsiTs

Score

10^/10

xred backdoor discovery persistence upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
xredline1@gmail.com
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HBMQLS.lnk	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe

Executes dropped EXE 5 IoCs

pid	Process
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
896	Synaptics.exe
2824	._cache_Synaptics.exe
1108	EWZJGF.exe
2388	EWZJGF.exe

Loads dropped DLL 6 IoCs

pid	Process
2124	c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2124	c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2124	c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
896	Synaptics.exe
896	Synaptics.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\HBMQLS = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\EWZJGF.exe\""	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe

AutoIT Executable 9 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2824-64-0x00000000009A0000-0x0000000000BA0000-memory.dmp	autoit_exe
behavioral1/memory/2604-70-0x00000000009B0000-0x0000000000BB0000-memory.dmp	autoit_exe
behavioral1/memory/2604-72-0x00000000009B0000-0x0000000000BB0000-memory.dmp	autoit_exe
behavioral1/memory/2604-79-0x00000000009B0000-0x0000000000BB0000-memory.dmp	autoit_exe
behavioral1/memory/1108-85-0x0000000000B90000-0x0000000000D90000-memory.dmp	autoit_exe
behavioral1/memory/2604-118-0x00000000009B0000-0x0000000000BB0000-memory.dmp	autoit_exe
behavioral1/memory/2604-124-0x00000000009B0000-0x0000000000BB0000-memory.dmp	autoit_exe
behavioral1/memory/2388-128-0x00000000000F0000-0x00000000002F0000-memory.dmp	autoit_exe
behavioral1/memory/2604-133-0x00000000009B0000-0x0000000000BB0000-memory.dmp	autoit_exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000012118-4.dat	upx
behavioral1/memory/2604-18-0x00000000009B0000-0x0000000000BB0000-memory.dmp	upx
behavioral1/memory/2824-40-0x00000000009A0000-0x0000000000BA0000-memory.dmp	upx
behavioral1/memory/2824-64-0x00000000009A0000-0x0000000000BA0000-memory.dmp	upx
behavioral1/memory/2604-70-0x00000000009B0000-0x0000000000BB0000-memory.dmp	upx
behavioral1/memory/2604-72-0x00000000009B0000-0x0000000000BB0000-memory.dmp	upx
behavioral1/memory/2604-79-0x00000000009B0000-0x0000000000BB0000-memory.dmp	upx
behavioral1/memory/1108-83-0x0000000000B90000-0x0000000000D90000-memory.dmp	upx
behavioral1/memory/1108-85-0x0000000000B90000-0x0000000000D90000-memory.dmp	upx
behavioral1/memory/2604-118-0x00000000009B0000-0x0000000000BB0000-memory.dmp	upx
behavioral1/memory/2604-124-0x00000000009B0000-0x0000000000BB0000-memory.dmp	upx
behavioral1/memory/2388-127-0x00000000000F0000-0x00000000002F0000-memory.dmp	upx
behavioral1/memory/2388-128-0x00000000000F0000-0x00000000002F0000-memory.dmp	upx
behavioral1/memory/2604-133-0x00000000009B0000-0x0000000000BB0000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EWZJGF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EWZJGF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSCript.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2332	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2964	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2964	EXCEL.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2604	2124	c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	30
PID 2124 wrote to memory of 2604	2124	c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	30
PID 2124 wrote to memory of 2604	2124	c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	30
PID 2124 wrote to memory of 2604	2124	c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	30
PID 2124 wrote to memory of 896	2124	c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	31
PID 2124 wrote to memory of 896	2124	c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	31
PID 2124 wrote to memory of 896	2124	c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	31
PID 2124 wrote to memory of 896	2124	c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	31
PID 896 wrote to memory of 2824	896	Synaptics.exe	32
PID 896 wrote to memory of 2824	896	Synaptics.exe	32
PID 896 wrote to memory of 2824	896	Synaptics.exe	32
PID 896 wrote to memory of 2824	896	Synaptics.exe	32
PID 2604 wrote to memory of 1684	2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	34
PID 2604 wrote to memory of 1684	2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	34
PID 2604 wrote to memory of 1684	2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	34
PID 2604 wrote to memory of 1684	2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	34
PID 2604 wrote to memory of 2328	2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	36
PID 2604 wrote to memory of 2328	2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	36
PID 2604 wrote to memory of 2328	2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	36
PID 2604 wrote to memory of 2328	2604	._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe	36
PID 1684 wrote to memory of 2332	1684	cmd.exe	37
PID 1684 wrote to memory of 2332	1684	cmd.exe	37
PID 1684 wrote to memory of 2332	1684	cmd.exe	37
PID 1684 wrote to memory of 2332	1684	cmd.exe	37
PID 1632 wrote to memory of 1108	1632	taskeng.exe	42
PID 1632 wrote to memory of 1108	1632	taskeng.exe	42
PID 1632 wrote to memory of 1108	1632	taskeng.exe	42
PID 1632 wrote to memory of 1108	1632	taskeng.exe	42
PID 1632 wrote to memory of 2388	1632	taskeng.exe	43
PID 1632 wrote to memory of 2388	1632	taskeng.exe	43
PID 1632 wrote to memory of 2388	1632	taskeng.exe	43
PID 1632 wrote to memory of 2388	1632	taskeng.exe	43

C:\Users\Admin\AppData\Local\Temp\c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
"C:\Users\Admin\AppData\Local\Temp\c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn HBMQLS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn HBMQLS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe /sc minute /mo 1
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2332
- - C:\Windows\SysWOW64\WSCript.exe
    WSCript C:\Users\Admin\AppData\Local\Temp\HBMQLS.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2328
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2824

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2964

C:\Windows\system32\taskeng.exe
taskeng.exe {F611A196-E007-4452-802D-BC4DDB0D225B} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe
  C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1108
- C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe
  C:\Users\Admin\AppData\Roaming\Windata\EWZJGF.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2388

Network

DNS

xred.mooo.com

Synaptics.exe

Remote address:

8.8.8.8:53

Request

xred.mooo.com

IN A

Response
DNS

freedns.afraid.org

Synaptics.exe

Remote address:

8.8.8.8:53

Request

freedns.afraid.org

IN A

Response

freedns.afraid.org

IN A

69.42.215.252
GET

http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Synaptics.exe

Remote address:

69.42.215.252:80

Request

GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1
User-Agent: MyApp
Host: freedns.afraid.org
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Tue, 31 Dec 2024 02:51:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Cache: MISS
DNS

docs.google.com

Synaptics.exe

Remote address:

8.8.8.8:53

Request

docs.google.com

IN A

Response

docs.google.com

IN A

216.58.214.174
GET

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

216.58.214.174:443

Request

GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache

Response

HTTP/1.1 303 See Other

Content-Type: application/binary
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 31 Dec 2024 02:52:16 GMT
Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: script-src 'report-sample' 'nonce-jX1XnHBiDndC9TA4Qd6m6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

216.58.214.174:443

Request

GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache
Cookie: NID=520=WRwuowbp-SyfjenmsbV1TxR6d2HGYdrcizclqCAIOQjGUA0SvAYqm-6lADTCWbb0z7UxN_ZEdkyxk4ifpAHyK60Ft2Th--tCae9HHUR3uwQSvl6cSsYScBM8iGzqDxiMQbt-eYPZYGxSpsN4jXlfVIBxn6rvItA0nasQAjWtUWnQbFA

Response

HTTP/1.1 303 See Other

Content-Type: application/binary
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 31 Dec 2024 02:52:17 GMT
Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Strict-Transport-Security: max-age=31536000
Cross-Origin-Opener-Policy: same-origin
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-gj0ZNcNABPV5Z87pWVuS8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

216.58.214.174:443

Request

GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache
Cookie: NID=520=WRwuowbp-SyfjenmsbV1TxR6d2HGYdrcizclqCAIOQjGUA0SvAYqm-6lADTCWbb0z7UxN_ZEdkyxk4ifpAHyK60Ft2Th--tCae9HHUR3uwQSvl6cSsYScBM8iGzqDxiMQbt-eYPZYGxSpsN4jXlfVIBxn6rvItA0nasQAjWtUWnQbFA

Response

HTTP/1.1 303 See Other

Content-Type: application/binary
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 31 Dec 2024 02:52:17 GMT
Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Strict-Transport-Security: max-age=31536000
Cross-Origin-Opener-Policy: same-origin
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-QN_nkPC6WSPS88Ypspn-ag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

c.pki.goog

Synaptics.exe

Remote address:

8.8.8.8:53

Request

c.pki.goog

IN A

Response

c.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.179.67
GET

http://c.pki.goog/r/r1.crl

Synaptics.exe

Remote address:

142.250.179.67:80

Request

GET /r/r1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: c.pki.goog

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 854
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Tue, 31 Dec 2024 02:07:48 GMT
Expires: Tue, 31 Dec 2024 02:57:48 GMT
Cache-Control: public, max-age=3000
Age: 2668
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
DNS

o.pki.goog

Synaptics.exe

Remote address:

8.8.8.8:53

Request

o.pki.goog

IN A

Response

o.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.179.67
GET

http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQD8Elu9WzbqaxI7ClVJiEyf

Synaptics.exe

Remote address:

142.250.179.67:80

Request

GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQD8Elu9WzbqaxI7ClVJiEyf HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Tue, 31 Dec 2024 02:28:29 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 1427
GET

http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDkqhDvrMuENxBpWocUnIUC

Synaptics.exe

Remote address:

142.250.179.67:80

Request

GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDkqhDvrMuENxBpWocUnIUC HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Tue, 31 Dec 2024 02:20:41 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 1896
DNS

drive.usercontent.google.com

Synaptics.exe

Remote address:

8.8.8.8:53

Request

drive.usercontent.google.com

IN A

Response

drive.usercontent.google.com

IN A

142.250.74.225
GET

https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

142.250.74.225:443

Request

GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Connection: Keep-Alive
Cache-Control: no-cache
Host: drive.usercontent.google.com

Response

HTTP/1.1 404 Not Found

X-GUploader-UploadID: AFiumC6Tt0NF1RnAjbIuQWdRf81XPm6_ua38KOcg2XnEzgloZVMbjeM4q0p2IGE6Q7-LEux8
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 31 Dec 2024 02:52:17 GMT
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-uKBx_gabrjbcDy0zOT9hKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Content-Length: 1652
Server: UploadServer
Set-Cookie: NID=520=WRwuowbp-SyfjenmsbV1TxR6d2HGYdrcizclqCAIOQjGUA0SvAYqm-6lADTCWbb0z7UxN_ZEdkyxk4ifpAHyK60Ft2Th--tCae9HHUR3uwQSvl6cSsYScBM8iGzqDxiMQbt-eYPZYGxSpsN4jXlfVIBxn6rvItA0nasQAjWtUWnQbFA; expires=Wed, 02-Jul-2025 02:52:17 GMT; path=/; domain=.google.com; HttpOnly
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Security-Policy: sandbox allow-scripts
GET

https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

142.250.74.225:443

Request

GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: drive.usercontent.google.com
Cache-Control: no-cache
Connection: Keep-Alive
Cookie: NID=520=WRwuowbp-SyfjenmsbV1TxR6d2HGYdrcizclqCAIOQjGUA0SvAYqm-6lADTCWbb0z7UxN_ZEdkyxk4ifpAHyK60Ft2Th--tCae9HHUR3uwQSvl6cSsYScBM8iGzqDxiMQbt-eYPZYGxSpsN4jXlfVIBxn6rvItA0nasQAjWtUWnQbFA

Response

HTTP/1.1 404 Not Found

X-GUploader-UploadID: AFiumC55cLJUuHs6fvbaD5Z8rjthyHJTIc5HKvbnNC3DN_7THxzUV3XCZ8NlH22AE_cQl_hv
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 31 Dec 2024 02:52:17 GMT
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-YSyizZU4Pa_N9El2w12CPw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Content-Length: 1652
Server: UploadServer
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Security-Policy: sandbox allow-scripts
GET

https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

142.250.74.225:443

Request

GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: drive.usercontent.google.com
Cache-Control: no-cache
Connection: Keep-Alive
Cookie: NID=520=WRwuowbp-SyfjenmsbV1TxR6d2HGYdrcizclqCAIOQjGUA0SvAYqm-6lADTCWbb0z7UxN_ZEdkyxk4ifpAHyK60Ft2Th--tCae9HHUR3uwQSvl6cSsYScBM8iGzqDxiMQbt-eYPZYGxSpsN4jXlfVIBxn6rvItA0nasQAjWtUWnQbFA

Response

HTTP/1.1 404 Not Found

X-GUploader-UploadID: AFiumC63bd_IrUWSClfBcw6fXKLYuMMfdqsBvRmngio7vpovVml7w2uHEts3C7eSkxU46aW-
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Tue, 31 Dec 2024 02:52:18 GMT
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Content-Security-Policy: script-src 'report-sample' 'nonce-Ljxe7MDJAeIDA1xXwq94rA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Cross-Origin-Opener-Policy: same-origin
Content-Length: 1652
Server: UploadServer
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Security-Policy: sandbox allow-scripts
DNS

www.microsoft.com

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

23.192.22.93
GET

http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

Remote address:

23.192.22.93:80

Request

GET /pkiops/crl/MicCodSigPCA2011_2011-07-08.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sun, 18 Aug 2024 00:23:49 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.microsoft.com

Response

HTTP/1.1 200 OK

Content-Length: 1078
Content-Type: application/octet-stream
Content-MD5: PjrtHAukbJio72s77Ag5mA==
Last-Modified: Thu, 31 Oct 2024 23:26:09 GMT
ETag: 0x8DCFA0366D6C4CA
x-ms-request-id: 46e337eb-b01e-0072-49f3-2b50a5000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 31 Dec 2024 02:52:47 GMT
Connection: keep-alive
TLS_version: UNKNOWN
ms-cv: CASMicrosoftCV7003d8ab.0
ms-cv-esi: CASMicrosoftCV7003d8ab.0
X-RTag: RT
DNS

crl.microsoft.com

Remote address:

8.8.8.8:53

Request

crl.microsoft.com

IN A

Response

crl.microsoft.com

IN CNAME

crl.www.ms.akadns.net

crl.www.ms.akadns.net

IN CNAME

a1363.dscg.akamai.net

a1363.dscg.akamai.net

IN A

2.18.190.73

a1363.dscg.akamai.net

IN A

2.18.190.80
GET

http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

Remote address:

2.18.190.73:80

Request

GET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 26 Sep 2024 02:21:11 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com

Response

HTTP/1.1 200 OK

Content-Length: 1036
Content-Type: application/octet-stream
Content-MD5: +oTkvMkqpdtzWrUHEQQM3g==
Last-Modified: Thu, 12 Dec 2024 00:06:56 GMT
ETag: 0x8DD1A40E476D877
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 53f572a3-201e-003d-2d33-4c21f1000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 31 Dec 2024 02:52:47 GMT
Connection: keep-alive

69.42.215.252:80

http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

http

Synaptics.exe

706 B
415 B
12
4

HTTP Request

GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

HTTP Response

200
172.111.138.100:5552

._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe

152 B
3
172.111.138.100:5552

._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe

152 B
3
216.58.214.174:443

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

tls, http

Synaptics.exe

1.9kB
15.3kB
16
18

HTTP Request

GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

303

HTTP Request

GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

303

HTTP Request

GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

303
142.250.179.67:80

http://c.pki.goog/r/r1.crl

http

Synaptics.exe

348 B
1.7kB
5
4

HTTP Request

GET http://c.pki.goog/r/r1.crl

HTTP Response

200
142.250.179.67:80

http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDkqhDvrMuENxBpWocUnIUC

http

Synaptics.exe

832 B
2.4kB
8
5

HTTP Request

GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQD8Elu9WzbqaxI7ClVJiEyf

HTTP Response

200

HTTP Request

GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDkqhDvrMuENxBpWocUnIUC

HTTP Response

200
142.250.74.225:443

https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

tls, http

Synaptics.exe

2.0kB
14.5kB
14
21

HTTP Request

GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

404

HTTP Request

GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

404

HTTP Request

GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

404
172.111.138.100:5552

._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe

152 B
3
23.192.22.93:80

http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

http

393 B
1.7kB
4
4

HTTP Request

GET http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

HTTP Response

200
2.18.190.73:80

http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

http

399 B
1.7kB
4
4

HTTP Request

GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

HTTP Response

200
172.111.138.100:5552

._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe

152 B
3
172.111.138.100:5552

._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe

152 B
3

8.8.8.8:53

xred.mooo.com

dns

Synaptics.exe

59 B
118 B
1
1

DNS Request

xred.mooo.com
8.8.8.8:53

freedns.afraid.org

dns

Synaptics.exe

64 B
80 B
1
1

DNS Request

freedns.afraid.org

DNS Response

69.42.215.252
8.8.8.8:53

docs.google.com

dns

Synaptics.exe

61 B
77 B
1
1

DNS Request

docs.google.com

DNS Response

216.58.214.174
8.8.8.8:53

c.pki.goog

dns

Synaptics.exe

56 B
107 B
1
1

DNS Request

c.pki.goog

DNS Response

142.250.179.67
8.8.8.8:53

o.pki.goog

dns

Synaptics.exe

56 B
107 B
1
1

DNS Request

o.pki.goog

DNS Response

142.250.179.67
8.8.8.8:53

drive.usercontent.google.com

dns

Synaptics.exe

74 B
90 B
1
1

DNS Request

drive.usercontent.google.com

DNS Response

142.250.74.225
8.8.8.8:53

www.microsoft.com

dns

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

23.192.22.93
8.8.8.8:53

crl.microsoft.com

dns

63 B
162 B
1
1

DNS Request

crl.microsoft.com

DNS Response

2.18.190.73

2.18.190.80

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.6MB

MD5
71386f37f17778126296ca734975db6d

SHA1
353818dcd74d06565fc0e8ac4416e594d29ecd0b

SHA256
c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae

SHA512
e5e0d87f91611bccfea16222c9afb7ac7b949f1762244ced01f9d8a78e2c992cfe8c1faaf1391f4cf107604a0e9f7a64fa4adda1c339d8dc85b27e7be610b83c

Download Submit
C:\Users\Admin\AppData\Local\Temp\HBMQLS.vbs

Filesize
964B

MD5
cf669df6b7a48b401f68e4a3cb55b51d

SHA1
38f6ffabc117e9986fd23e4893f5e273be356785

SHA256
fcf78a95a680d881a2aed5bed7a985d40db666bc39cdfb27fecb91e6f45dff62

SHA512
e4e9791bc9ad6bc5dfc3d9e1b5bdb1b778fe634ccf5f217212082428003587a72ae04d028deae7d89f10e4563b95ea540bc710faa670d4f62d5dfb30c332fc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\U7kJpjVJ.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_c1317da0fd0dc3d73b38634ea586016f6f651f52acc576fbae8b82721c83e9ae.exe

Filesize
930KB

MD5
36f4c5372c6391f782c2db490081746f

SHA1
a0b1ec84b0a2db8f801981e247578217b71b38da

SHA256
1fe023f69f42fcd4be4baa180bbff00b7ffe51c553211dd0df45fb7ff71148b8

SHA512
111c1915d81141398b6bb7a0aa0e98896fb05d5548ace8fd1e0e23343eae60ea1e3d6617d3f5f883b96c8e05f5f868a280683341810896c00fa6ef1f68338992

Download Submit
memory/896-76-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/896-73-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/896-71-0x0000000005930000-0x0000000005B30000-memory.dmp

Filesize
2.0MB

Download
memory/896-119-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/1108-83-0x0000000000B90000-0x0000000000D90000-memory.dmp

Filesize
2.0MB

Download
memory/1108-85-0x0000000000B90000-0x0000000000D90000-memory.dmp

Filesize
2.0MB

Download
memory/2124-17-0x0000000005540000-0x0000000005740000-memory.dmp

Filesize
2.0MB

Download
memory/2124-0-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2124-27-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/2388-127-0x00000000000F0000-0x00000000002F0000-memory.dmp

Filesize
2.0MB

Download
memory/2388-128-0x00000000000F0000-0x00000000002F0000-memory.dmp

Filesize
2.0MB

Download
memory/2604-79-0x00000000009B0000-0x0000000000BB0000-memory.dmp

Filesize
2.0MB

Download
memory/2604-72-0x00000000009B0000-0x0000000000BB0000-memory.dmp

Filesize
2.0MB

Download
memory/2604-74-0x0000000000790000-0x00000000007A0000-memory.dmp

Filesize
64KB

Download
memory/2604-70-0x00000000009B0000-0x0000000000BB0000-memory.dmp

Filesize
2.0MB

Download
memory/2604-118-0x00000000009B0000-0x0000000000BB0000-memory.dmp

Filesize
2.0MB

Download
memory/2604-45-0x0000000000790000-0x00000000007A0000-memory.dmp

Filesize
64KB

Download
memory/2604-124-0x00000000009B0000-0x0000000000BB0000-memory.dmp

Filesize
2.0MB

Download
memory/2604-18-0x00000000009B0000-0x0000000000BB0000-memory.dmp

Filesize
2.0MB

Download
memory/2604-133-0x00000000009B0000-0x0000000000BB0000-memory.dmp

Filesize
2.0MB

Download
memory/2824-64-0x00000000009A0000-0x0000000000BA0000-memory.dmp

Filesize
2.0MB

Download
memory/2824-40-0x00000000009A0000-0x0000000000BA0000-memory.dmp

Filesize
2.0MB

Download
memory/2964-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.