Analysis
-
max time kernel
111s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2025, 09:56
Behavioral task
behavioral1
Sample
9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe
Resource
win10v2004-20241007-en
General
-
Target
9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe
-
Size
2.5MB
-
MD5
c895bd0301914b5cc815ee78412f9531
-
SHA1
22fab00d4306c2befa3d8524d4dc7af3bbea787c
-
SHA256
9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf
-
SHA512
0916e4ed5213f607e2add37e96423fb7bf93eee1ecc7a97a1a277db569e2c98bcf92d547e49cd6a3ad693a7914424712b2252660bf386a434ed1be9439b26e1e
-
SSDEEP
49152:ynsHyjtk2MYC5GDMBPcFuy8/RxJw/+NqhrN5h6jZ:ynsmtk2aNPPJxJdF
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 4252 ._cache_9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 2516 Synaptics.exe 376 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4712 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4812 wrote to memory of 4252 4812 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 84 PID 4812 wrote to memory of 4252 4812 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 84 PID 4812 wrote to memory of 4252 4812 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 84 PID 4812 wrote to memory of 2516 4812 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 85 PID 4812 wrote to memory of 2516 4812 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 85 PID 4812 wrote to memory of 2516 4812 9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe 85 PID 2516 wrote to memory of 376 2516 Synaptics.exe 86 PID 2516 wrote to memory of 376 2516 Synaptics.exe 86 PID 2516 wrote to memory of 376 2516 Synaptics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe"C:\Users\Admin\AppData\Local\Temp\9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\._cache_9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe"C:\Users\Admin\AppData\Local\Temp\._cache_9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe"2⤵
- Executes dropped EXE
PID:4252
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:376
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5c895bd0301914b5cc815ee78412f9531
SHA122fab00d4306c2befa3d8524d4dc7af3bbea787c
SHA2569273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf
SHA5120916e4ed5213f607e2add37e96423fb7bf93eee1ecc7a97a1a277db569e2c98bcf92d547e49cd6a3ad693a7914424712b2252660bf386a434ed1be9439b26e1e
-
C:\Users\Admin\AppData\Local\Temp\._cache_9273e919971b79e25d78053ebcf8c816dd12fce94cca5b8ce2625df4cee078cf.exe
Filesize1.8MB
MD5eb3dea253980763adc4427d608d8a4d5
SHA1b029e439024edb3a11ff5529040ef6a6c8ab05e6
SHA2561b189d362d65cc9464a40d06ae01ffddc864b7f4c8a94d5cea1626bb71cd8749
SHA512d92b98bf5bc3a92d307703437b190bceba71bdafa322ad1f20653dd2041bc82a53be49334caf3eb78708ce5dd4026f64173e90a0f9e9d06289c606be7c99231c
-
Filesize
22KB
MD5e76a49dde886177ce8623304fb1acf77
SHA1bca1016808d8e3173da260d4bf468739328d5749
SHA256cc8c812ba3442a1f4696d5f7e749238e8cfb3afe5bcd50f6da8f3b978f2975ee
SHA5126f3fa0f6698fa1ff61c6754876433763ae7bb9837f93245545005254ca8ca4390f5b7d2ef0c6196f13ccb7a38c1850d987e373e2c657ebc22b68437f30fd1ddc
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04