Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2025 04:14
Behavioral task
behavioral1
Sample
e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe
Resource
win10v2004-20241007-en
General
-
Target
e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe
-
Size
833KB
-
MD5
bde046179ec59bf13aac25e6266fd7a1
-
SHA1
6d57757618e7652f8c61be42bc082c7717c908c9
-
SHA256
e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94
-
SHA512
9875884d0a556cd8cf741730eecf89d56c8597fb3ed327ce72c1853f2a82532cc0c09f8495dbf203e1c6cf62318b013e69830114b97810abbb65d5ceceea6bab
-
SSDEEP
12288:hMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9sdVwavj:hnsJ39LyjbJkQFMhmC+6GD9kVwa7
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 2764 ._cache_e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe 5084 Synaptics.exe 3768 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1472 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4196 wrote to memory of 2764 4196 e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe 83 PID 4196 wrote to memory of 2764 4196 e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe 83 PID 4196 wrote to memory of 2764 4196 e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe 83 PID 4196 wrote to memory of 5084 4196 e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe 84 PID 4196 wrote to memory of 5084 4196 e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe 84 PID 4196 wrote to memory of 5084 4196 e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe 84 PID 5084 wrote to memory of 3768 5084 Synaptics.exe 85 PID 5084 wrote to memory of 3768 5084 Synaptics.exe 85 PID 5084 wrote to memory of 3768 5084 Synaptics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe"C:\Users\Admin\AppData\Local\Temp\e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\._cache_e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe"C:\Users\Admin\AppData\Local\Temp\._cache_e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2764
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3768
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
833KB
MD5bde046179ec59bf13aac25e6266fd7a1
SHA16d57757618e7652f8c61be42bc082c7717c908c9
SHA256e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94
SHA5129875884d0a556cd8cf741730eecf89d56c8597fb3ed327ce72c1853f2a82532cc0c09f8495dbf203e1c6cf62318b013e69830114b97810abbb65d5ceceea6bab
-
C:\Users\Admin\AppData\Local\Temp\._cache_e663895e2a72754e6168de9f40923e414465dd85943a41fca91fd0c107935f94.exe
Filesize80KB
MD5a087f01b97ea6321858980fe24abe57a
SHA1ef35aeac260b667eafb3d77ed36cedbd230b5ae9
SHA2564455d735c4ed7439a6633a3707ff2944c5c72f653f19fef2230e11b3391276d2
SHA5129ea4727aa1a04a862ec45852f76bde6c28d45cd848f21a3583fec47d1294e584595dcb780572aed7ef09b97d2cee5b40e22a579e7aedf01e403f49138bf6d58e
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04