Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/01/2025, 09:56
Behavioral task
behavioral1
Sample
9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe
Resource
win10v2004-20241007-en
General
-
Target
9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe
-
Size
2.5MB
-
MD5
c895bd0301914b5cc815ee78412f9531
-
SHA1
22fab00d4306c2befa3d8524d4dc7af3bbea787c
-
SHA256
9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf
-
SHA512
0916e4ed5213f607e2add37e96423fb7bf93eee1ecc7a97a1a277db569e2c98bcf92d547e49cd6a3ad693a7914424712b2252660bf386a434ed1be9439b26e1e
-
SSDEEP
49152:ynsHyjtk2MYC5GDMBPcFuy8/RxJw/+NqhrN5h6jZ:ynsmtk2aNPPJxJdF
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
pid Process 1984 ._cache_9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 2140 Synaptics.exe 2824 ._cache_Synaptics.exe -
Loads dropped DLL 5 IoCs
pid Process 1992 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 1992 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 1992 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 2140 Synaptics.exe 2140 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2760 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2760 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1984 1992 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 30 PID 1992 wrote to memory of 1984 1992 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 30 PID 1992 wrote to memory of 1984 1992 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 30 PID 1992 wrote to memory of 1984 1992 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 30 PID 1992 wrote to memory of 2140 1992 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 31 PID 1992 wrote to memory of 2140 1992 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 31 PID 1992 wrote to memory of 2140 1992 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 31 PID 1992 wrote to memory of 2140 1992 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 31 PID 2140 wrote to memory of 2824 2140 Synaptics.exe 32 PID 2140 wrote to memory of 2824 2140 Synaptics.exe 32 PID 2140 wrote to memory of 2824 2140 Synaptics.exe 32 PID 2140 wrote to memory of 2824 2140 Synaptics.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe"C:\Users\Admin\AppData\Local\Temp\9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\._cache_9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe"C:\Users\Admin\AppData\Local\Temp\._cache_9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe"2⤵
- Executes dropped EXE
PID:1984
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:2824
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5c895bd0301914b5cc815ee78412f9531
SHA122fab00d4306c2befa3d8524d4dc7af3bbea787c
SHA2569273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf
SHA5120916e4ed5213f607e2add37e96423fb7bf93eee1ecc7a97a1a277db569e2c98bcf92d547e49cd6a3ad693a7914424712b2252660bf386a434ed1be9439b26e1e
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
24KB
MD5a7166c4f91a332c8d83e8e184752c729
SHA19d80e3cdcff7fde28f94bb5b64054095a36ca6ea
SHA25630f99fa250e7a7ab84a3366a16d2276b0b875d674fe11f3804f02c460d3b578a
SHA5127c77d2f6c810f951a377fda37ba071f8da91a81290de1c71136814c5da4571a4b7c7effdc7c0f73a9d7494daefa3dee8e4d7e8b478cdd64046e857a5d3a2a90d
-
\Users\Admin\AppData\Local\Temp\._cache_9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe
Filesize1.8MB
MD5eb3dea253980763adc4427d608d8a4d5
SHA1b029e439024edb3a11ff5529040ef6a6c8ab05e6
SHA2561b189d362d65cc9464a40d06ae01ffddc864b7f4c8a94d5cea1626bb71cd8749
SHA512d92b98bf5bc3a92d307703437b190bceba71bdafa322ad1f20653dd2041bc82a53be49334caf3eb78708ce5dd4026f64173e90a0f9e9d06289c606be7c99231c