Analysis
-
max time kernel
111s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2025 19:18
Behavioral task
behavioral1
Sample
08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe
Resource
win10v2004-20241007-en
General
-
Target
08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe
-
Size
1.0MB
-
MD5
9111a0cc916fa0b277fb01452aee07b0
-
SHA1
b27ddf7448f93dd3e1a6a8390cec4dc7ff89bb5d
-
SHA256
08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4
-
SHA512
63ff81d2bc7cd4663039308bb71a1f9ea3e438c61b2e7927bf23ae5410384b854cb4cfcd94009363b88678043c2b36f3f846d4d57d1f20b2faf231fcaf836198
-
SSDEEP
24576:KnsJ39LyjbJkQFMhmC+6GD9wOX2YGyzSDuAWjJC:KnsHyjtk2MYC5GDyOX2YgQs
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 4924 ._cache_08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe 5040 Synaptics.exe 1932 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe -
resource yara_rule behavioral2/files/0x000c000000023bc7-5.dat upx behavioral2/memory/4924-69-0x0000000000400000-0x000000000058A000-memory.dmp upx behavioral2/memory/4924-132-0x0000000000400000-0x000000000058A000-memory.dmp upx behavioral2/memory/1932-199-0x0000000000400000-0x000000000058A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4008 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4008 EXCEL.EXE 4008 EXCEL.EXE 4008 EXCEL.EXE 4008 EXCEL.EXE 4008 EXCEL.EXE 4008 EXCEL.EXE 4008 EXCEL.EXE 4008 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1276 wrote to memory of 4924 1276 08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe 83 PID 1276 wrote to memory of 4924 1276 08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe 83 PID 1276 wrote to memory of 4924 1276 08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe 83 PID 1276 wrote to memory of 5040 1276 08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe 85 PID 1276 wrote to memory of 5040 1276 08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe 85 PID 1276 wrote to memory of 5040 1276 08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe 85 PID 5040 wrote to memory of 1932 5040 Synaptics.exe 86 PID 5040 wrote to memory of 1932 5040 Synaptics.exe 86 PID 5040 wrote to memory of 1932 5040 Synaptics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe"C:\Users\Admin\AppData\Local\Temp\08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\._cache_08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4924
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1932
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD59111a0cc916fa0b277fb01452aee07b0
SHA1b27ddf7448f93dd3e1a6a8390cec4dc7ff89bb5d
SHA25608929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4
SHA51263ff81d2bc7cd4663039308bb71a1f9ea3e438c61b2e7927bf23ae5410384b854cb4cfcd94009363b88678043c2b36f3f846d4d57d1f20b2faf231fcaf836198
-
C:\Users\Admin\AppData\Local\Temp\._cache_08929148e8d4648c1c9a2be137a0ed622d380628463e45810f4822aa4c85d8c4N.exe
Filesize287KB
MD5ffa637abd482b5e7d3fb75182f43f080
SHA1d5589ff9d01d8d64669e41161f71e9969ee4204f
SHA2564d3d363b5b3dcd9fa516b481c92d62c02aed804318bdc4d5e97a68bb6e6d62db
SHA512515ed43190b9b73feb389efd125cbd4cd435b90189adf51a215cb28d70c564c936cfa6f7ec46b606212979947f341e2b854d33fdeefe190163e508dcfdd3375b
-
Filesize
23KB
MD5bec2c3b4beb5dd5527e463797f879dea
SHA1b802851d7b17817170c0b541597d607127b963aa
SHA2568183a6856892050c92e7cbd98c5e3cdfe30dab83468d22e3be515fcd13819a7f
SHA512a25f281adbb9fd7d03abd645bf4db1ff2bf01b8f13a4a8e5e079807122be4928b3de740efe2a585e50c480b554a288b4688d23245d0d506dea191081e60faf73
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04