xred | 29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bf

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
Size

2.4MB
MD5

3b4645f991532abe60ba20d5f4733aa0
SHA1

b2c88769c1dd5f4c4e55ab50fe6112e277d3a4fd
SHA256

29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bf
SHA512

dcb3fafdc053f180cba418a75974398073d2cdb3861686827a0317f77d3d308760432c8fcee40cdf012846b72ff5004d103ab01f0ca8c32555359b41546febab
SSDEEP

49152:nnsHyjtk2MYC5GD/14+yZbWBgo3RFH54jcwcJOi7Wz4xwI+M/ae4:nnsmtk2aA1fyZbWBgo3PH541cJrWz4xq

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
2816	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
2612	Synaptics.exe
1532	._cache_Synaptics.exe

Loads dropped DLL 21 IoCs

pid	Process
2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
2816	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
2816	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
2816	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
2816	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
2612	Synaptics.exe
2612	Synaptics.exe
1532	._cache_Synaptics.exe
1532	._cache_Synaptics.exe
1532	._cache_Synaptics.exe
1532	._cache_Synaptics.exe
1532	._cache_Synaptics.exe
2816	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
2816	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
2816	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
1532	._cache_Synaptics.exe
1532	._cache_Synaptics.exe
1532	._cache_Synaptics.exe
1532	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\LoginDetectorVAG.exe	._cache_Synaptics.exe
File created	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\LoginDetectorVAG.exe	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
File created	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\Uninstall.exe	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
File created	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagau.dll	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
File created	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagmm.dll	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
File created	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagvd2.dll	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
File created	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DICT\edc_de.hlp	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
File created	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DICT\me_en.hlp	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
File opened for modification	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\Uninstall.exe	._cache_Synaptics.exe
File opened for modification	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagmm.dll	._cache_Synaptics.exe
File created	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagvd.dll	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
File created	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagau2.dll	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
File created	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagmm2.dll	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
File created	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\USB\VAGdashCOM.inf	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
File opened for modification	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\USB\VAGdashCOM.inf	._cache_Synaptics.exe
File opened for modification	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DICT\me_de.hlp	._cache_Synaptics.exe
File opened for modification	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DICT\me_en.hlp	._cache_Synaptics.exe
File opened for modification	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagmm2.dll	._cache_Synaptics.exe
File opened for modification	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagvd2.dll	._cache_Synaptics.exe
File created	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\dat.dat	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
File created	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DICT\me_de.hlp	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
File opened for modification	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\dat.dat	._cache_Synaptics.exe
File opened for modification	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagau.dll	._cache_Synaptics.exe
File opened for modification	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagvd.dll	._cache_Synaptics.exe
File opened for modification	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagau2.dll	._cache_Synaptics.exe
File opened for modification	C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DICT\edc_de.hlp	._cache_Synaptics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe

NSIS installer 5 IoCs

installer

resource	yara_rule
behavioral1/files/0x0003000000011c28-4.dat	nsis_installer_1
behavioral1/files/0x0003000000011c28-4.dat	nsis_installer_2
behavioral1/files/0x0007000000016ca0-16.dat	nsis_installer_2
behavioral1/files/0x0005000000019358-253.dat	nsis_installer_1
behavioral1/files/0x0005000000019358-253.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2140	EXCEL.EXE

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2816	._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
1532	._cache_Synaptics.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2140	EXCEL.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2816	2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe	31
PID 2676 wrote to memory of 2816	2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe	31
PID 2676 wrote to memory of 2816	2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe	31
PID 2676 wrote to memory of 2816	2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe	31
PID 2676 wrote to memory of 2816	2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe	31
PID 2676 wrote to memory of 2816	2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe	31
PID 2676 wrote to memory of 2816	2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe	31
PID 2676 wrote to memory of 2612	2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe	32
PID 2676 wrote to memory of 2612	2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe	32
PID 2676 wrote to memory of 2612	2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe	32
PID 2676 wrote to memory of 2612	2676	29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe	32
PID 2612 wrote to memory of 1532	2612	Synaptics.exe	33
PID 2612 wrote to memory of 1532	2612	Synaptics.exe	33
PID 2612 wrote to memory of 1532	2612	Synaptics.exe	33
PID 2612 wrote to memory of 1532	2612	Synaptics.exe	33
PID 2612 wrote to memory of 1532	2612	Synaptics.exe	33
PID 2612 wrote to memory of 1532	2612	Synaptics.exe	33
PID 2612 wrote to memory of 1532	2612	Synaptics.exe	33

C:\Users\Admin\AppData\Local\Temp\29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
"C:\Users\Admin\AppData\Local\Temp\29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2816
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1532

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DICT\edc_de.hlp

Filesize
10KB

MD5
68c17c53805e453620669a177d0cb997

SHA1
031d02b3cd1d928bdc6e638f6ec7e63d5098edd2

SHA256
fddc82ac1f5057db65ee0e9728e5de45e7a4fd53e1e719a85046cf4cf37ceb50

SHA512
4dc3a1056d9b9e68f702bb0a0e3ebc42a2473b5d41b701d9b399ea7b076f35727623c8deff63c2149070990e30fac7fed99c54270a972d2dd89d3c340ef38a25

Download Submit
C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DICT\me_de.hlp

Filesize
3KB

MD5
f42bb3bbe738e571b819897513014e68

SHA1
87b4247483fbfaa90c3f835037f40b8841a6e7a1

SHA256
66bfc29a2b27f113a8c074e348ddebe08dd5b9d1c59a0e3a482ac4f263fe54f8

SHA512
39a2de1043deb2a68987d653417713fa8322eb13f51adba0b3d4dd846eb1fc689fde01322bc9b6fb1c7ac375e2e36a4f2829c18810d7144de93399b7b799a88f

Download Submit
C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DICT\me_en.hlp

Filesize
3KB

MD5
fe238c5794a35f24061b9d2c96b3173b

SHA1
5691dba7095ba9eafbd2344f3fc5e2b6ea313184

SHA256
fb8c680655f1df103e021b23dc7cc7dcbfdf89b01fad29186b836b2820862c97

SHA512
99efa5a5f562c2b308b6994ab5dad6344fca90b871753e4df19bcfab06ca8bbc76ed47ff534053adf5105b80d024b2a4a94b6d74424d9f97b3d2a0432d640e00

Download Submit
C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagau2.dll

Filesize
3KB

MD5
852bfb77a0e6ad852c1254a7fd008e58

SHA1
83fdb1b66ebac5ba1ec713e05c51a43ce5682987

SHA256
55403491d3c9b111619ffd6820db3b6e079d5b2d53cc351e7e0e4eafe3977c91

SHA512
1361386d6432556a80c4a2d77f8a7b14c3c7b76c0fb0b6ec6c382db1c3608e6feae613a7cfe27baa7e036b91623e2476971a891eb420c98d83a62b8f9a104f12

Download Submit
C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagmm.dll

Filesize
105KB

MD5
d711c9521efd681b854f7a7f4e82ff2c

SHA1
b335273f595f11aaeb65e83f8fa9c9c7ccea3455

SHA256
8bd4442b7720bd2e4dbbcce6399e71b8818d64a6442b04d9c8c38ac03068075d

SHA512
d184c6f9297eff1e16a7ab7a71a93ab50aa42416e16fee8d8cd10ad9301ab33a1ddf28ff08aa6346a8343b6264603dd3c6a927045c6e32f6a267c286b4b9da5a

Download Submit
C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagvd.dll

Filesize
115KB

MD5
3e62a7c9dc559f9e15563f0c599b625e

SHA1
ad905c324ddcb5833d9122901c46cc7bcb7f8e8e

SHA256
3b537aacfa0aa160e7b8ac48c592ca75e77692602a65f541c58ab15e922ebf67

SHA512
8c095db00b79fe21226dce2d8604aefa68897b622c471929b43575b2522400d68a96744a7ac75996342c2b97f7f0775ae9bf01e1cbaf021c62728fc8cd9d9ed3

Download Submit
C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\DLL\vagvd2.dll

Filesize
123KB

MD5
ccee2d688839d4cf51fd8098943463e0

SHA1
cbd034e8e5a0b8ba2f4cda0b0071476f54d23ab0

SHA256
8a4544bcc5bc0cec0d303845060118d98f3aa70a2fb2f5d20192c67587fb6003

SHA512
fe081a75dab782e9b8df4bd6bd4cc5281b2fa07f76dba1f4e53a7099f02b53a987ea57548d3960f5dbe0cee8dd8bf6b54ee56f7972aafbcd9fffa98dac422234

Download Submit
C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\Uninstall.exe

Filesize
63KB

MD5
7f1c07732b1044b9c6dcf5c13770dd01

SHA1
b284a42ad97f2f1150f04f11198e257850b8d520

SHA256
d01841c85b3e05931ad98e32903f0f43d8632c8bfb30e2dbaa4abb1fec07f456

SHA512
1b4646ea7c5dea9d4b0f295de44884b30a333b6862b4c173a155c09afea521f19c90debc309fb75d9d2f744921bc58ee92a196175d3d582904f743ad01b31280

Download Submit
C:\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\dat.dat

Filesize
19KB

MD5
d76dac23a7334bdae8021728c38c7c27

SHA1
ece276c6d2235692cffeada366d3d35f8babfb97

SHA256
b35f202ac5bba815265222036252b205e846b53bdf59080629af8ef1be69dc3a

SHA512
37498a3af8f5a27d250b4cde338cbbfea2d7876afc0a8852494f2bd3d338f1ca950599d8d697044614b193b1dd89ba04cf7ab9af74bb32cdf82240978ab2e94b

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LoginDetectorVAG\LoginDetectorVAG.lnk

Filesize
2KB

MD5
c9a92645071045b654375dda24395f03

SHA1
eca2120c28ba5cdce65dcca7a7a38c4fa6526c3e

SHA256
8f9a57fd292e9f698a02b78aa31b8a81826f5a5bbfa2e194634389398afc5b1d

SHA512
b930b0a2993ab559423bb6431fdca3a3e1988a6a199a257d3a86f092b02915ce1cada09aad22aa29db651af2277a4ba3a92f4c8a2b895e2b2d501a4099d3c36e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LoginDetectorVAG\Uninstall.lnk

Filesize
1KB

MD5
d652a7b9c657bb5e017ea2a7fbe4fa2d

SHA1
6af1726210917088ba786a6b57a8fa81cc1302a9

SHA256
7b04f7e09490a3ee8e5d90904b1118e5dc41c9da6a296deea90030215a643143

SHA512
9a4d4b47f4b3c87ff8c88b07ccc79badf89d5f13099882982d5637fc2e129e1a25b13eeb6d7d14154cc4700464e62148ffa8b8ed34e5eff3171af2bafe8fe8b8

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe

Filesize
2.4MB

MD5
3b4645f991532abe60ba20d5f4733aa0

SHA1
b2c88769c1dd5f4c4e55ab50fe6112e277d3a4fd

SHA256
29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bf

SHA512
dcb3fafdc053f180cba418a75974398073d2cdb3861686827a0317f77d3d308760432c8fcee40cdf012846b72ff5004d103ab01f0ca8c32555359b41546febab

Download Submit
C:\Users\Admin\AppData\Local\Temp\d3wZ9wDC.xlsm

Filesize
17KB

MD5
af4d37aad8b34471da588360a43e768a

SHA1
83ed64667d4e68ea531b8bcf58aab3ed4a5ca998

SHA256
e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1

SHA512
74f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst1CE4.tmp\ioSpecial.ini

Filesize
700B

MD5
da814a4d6dfdd6c3464c7cda392da8dd

SHA1
5841bc4404cace14ea84bb7d000384b8c677ec5c

SHA256
03273d16197d6662f56f7cc1e67d0fdb2190fe7473f49a563d9be6deb1bd9406

SHA512
393e97f3f1ad67f8b9641e809a4735efeed60aee69fcc355452b84559abe6c1c8601574a55c3dbcda46b35a23422e229ecdfff243dc41b07c7471ea8e32869ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst1CE4.tmp\ioSpecial.ini

Filesize
405B

MD5
86725b3cc4d7a6d0ffa9fe72a42d59ee

SHA1
7c6e07a152eb77d6c12cdc5be64efbf506bf68dc

SHA256
23155b81e3eb23754a551d3fd3fb203daba3b9507341e2400e1896297f2a7e88

SHA512
842cef402e9ef0bc158b8fe8d021d1c929d0e75987922b0b38811d3183929bc9cc1b81c0e0bef067a347cf7c510f4a1a5626f230986d113830d695382956ae6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy22CD.tmp\InstallOptions.dll

Filesize
14KB

MD5
f62d03fcb1473110e920a9bb2c701006

SHA1
c48444ef2daa60dcdf91f1645cd4ecd8e66545f7

SHA256
17e2f205af12d5a86638dc83c95fc69199c41af2fa6daeb1e91ec330f68c5372

SHA512
701d531d405d08054d53298141d5bbd56e74df7b22bcea5f9f0e5c4407421ea0ca9617aa84e740dc1dc44e6d14e58852c1ca2087213cc2319f2da44eaed0bc05

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy22CD.tmp\ioSpecial.ini

Filesize
700B

MD5
80f097006b90d7b0b667f8e385b241eb

SHA1
b7daf3d7a217f5bcb018cae29de428db90096588

SHA256
abd8bfbbac30b9891a4f01778f6aa65e91ce5401f4c1c459222e1569beab6d88

SHA512
b69787facae2a86eda59cef8a05246c7aa982a6c7e76aafd28a66becea165cec786d4b7fc6af406a09b64b2ec535d8e402041a7d38f8fc666f8dfa6f51e7051e

Download Submit
\Program Files (x86)\VAGDashCOM\LoginDetectorVAG\LoginDetectorVAG.exe

Filesize
3.3MB

MD5
bfc7075df4dedc8d27a448fa049c1ae9

SHA1
ceaf35afd0e73d0b575380792612265d9e0ae7a3

SHA256
8da6c9c9e7093d873bfcb32d90103ff400b3d9bd74111ec7a38cdb7841feffaf

SHA512
895f645bbe541530b53527fe4dfefc678896dfba717f195a5d9b2632760468c704e06f64ac4d00c840e9814adadc568c2afed57da43235503b4a1194ca0eb93a

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_29a4b28a5bf962b4199486b9ae16431f4b338b7ea1c752b407be6e27579570bfN.exe

Filesize
1.7MB

MD5
c768f7fb0bcc48b31aea0d739ee4d072

SHA1
54e7330e3ba39704524bde99578acdad479b7896

SHA256
c82d6599b7b900469d0f9ff02fe3e3badc488703f877d23b31e71a3bf8604d2c

SHA512
cd5c8ca0af02375538cabc79daa3f7bdde430383fe1f1a540814acc1b86941ac21f463c54ff0e0f2fa5209d21f32e48d25031dff62e9d8fbbc74b5b893035d7a

Download Submit
\Users\Admin\AppData\Local\Temp\nst1CE4.tmp\LangDLL.dll

Filesize
5KB

MD5
c9ac0758ce8c10793d39655064c653cb

SHA1
8ba1f9dfcc671b5102f5940da67570c28252bc71

SHA256
161d69c50e5c50d853fda129b6f6f6bc241214b87d13a33bf93543e7e6886119

SHA512
54a8c2ded9a42de867c8a89a11701bcdb5d51aea168c4f3ffe8991859cf26f15d478b6111c85732c1059edbfd9408e42ca830706347a8ac87c5064e47d823349

Download Submit
\Users\Admin\AppData\Local\Temp\nst1CE4.tmp\StartMenu.dll

Filesize
7KB

MD5
3d8f82aa21fd7861890594027f39879f

SHA1
5fecbecabc15f639c7b3fb57400f6ca6e192a73e

SHA256
4bc38ffc6d1b09108be0031874bbebb3bd892eac86498c76a60a33c1e3c80d9e

SHA512
28ebf820047a27e3a7f0f2fa593af5492e27dddf62ea0c2ca633840fa68fb8b893b1c194f8456869d175eaf5a34f6146fb01f95898007ce19ed29438a1fee65e

Download Submit
memory/1532-333-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/2140-53-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2612-213-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/2612-288-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/2612-327-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/2676-34-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/2676-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2816-332-0x00000000039E0000-0x00000000039F0000-memory.dmp

Filesize
64KB

Download
memory/2816-240-0x00000000039E0000-0x00000000039F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads