Analysis
-
max time kernel
112s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2025, 11:17
Behavioral task
behavioral1
Sample
c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe
Resource
win10v2004-20241007-en
General
-
Target
c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe
-
Size
974KB
-
MD5
ea97e93b1ed967112ec77ae97744bdfc
-
SHA1
43a159ca2ccffe816f9fdd05ddaa145cae0c1460
-
SHA256
c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482
-
SHA512
483a6d22645f92a53afe9e92fc74295dfeb7a5ec43e7af95476e83f42d72ef24396ca5d3a1d3a47eb7b3a42e4f9fb1a8af33f9ca7763ed3cbef93bd775dae4d4
-
SSDEEP
12288:vMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9JP04BzFEz+MdaaNW:vnsJ39LyjbJkQFMhmC+6GD9+GzFmXV0
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 3824 ._cache_c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe 436 Synaptics.exe 4000 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4328 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4328 EXCEL.EXE 4328 EXCEL.EXE 4328 EXCEL.EXE 4328 EXCEL.EXE 4328 EXCEL.EXE 4328 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1472 wrote to memory of 3824 1472 c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe 85 PID 1472 wrote to memory of 3824 1472 c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe 85 PID 1472 wrote to memory of 3824 1472 c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe 85 PID 1472 wrote to memory of 436 1472 c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe 86 PID 1472 wrote to memory of 436 1472 c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe 86 PID 1472 wrote to memory of 436 1472 c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe 86 PID 436 wrote to memory of 4000 436 Synaptics.exe 87 PID 436 wrote to memory of 4000 436 Synaptics.exe 87 PID 436 wrote to memory of 4000 436 Synaptics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe"C:\Users\Admin\AppData\Local\Temp\c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\._cache_c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe"C:\Users\Admin\AppData\Local\Temp\._cache_c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3824
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4000
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4328
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
974KB
MD5ea97e93b1ed967112ec77ae97744bdfc
SHA143a159ca2ccffe816f9fdd05ddaa145cae0c1460
SHA256c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482
SHA512483a6d22645f92a53afe9e92fc74295dfeb7a5ec43e7af95476e83f42d72ef24396ca5d3a1d3a47eb7b3a42e4f9fb1a8af33f9ca7763ed3cbef93bd775dae4d4
-
C:\Users\Admin\AppData\Local\Temp\._cache_c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe
Filesize220KB
MD585c890c6e1e01134b6bcd3a388a1fbdd
SHA1a7dd8a21a3ded56c0ad565e5bd588124d7cbf1bd
SHA2562f4ebf3b8ed9891d49f9d87433cfaedd67928aa31ad12f8d084d99ffa18d51a7
SHA5125c54cb77eb5eae4ebb45dc1e1f8d544b8c9eb9ff028c26ca2262c02f8193c9ccf78ef821085c4e78a7906b7b423e493235c9e6daea4f83dde2e65b517133ebdc
-
Filesize
20KB
MD52428c3b2a9fa27e8b2b6a70137700e37
SHA1d6e0da8a7b26f6124efbf3c9f0b0972eea9466a2
SHA25634adcf54cf444622157de37bfdaef2b9e6e53c7d0d87da6c744a85f36b9f0936
SHA512c9b6d7034be4d68e67a8262b053c6fe9358ab2876843920fcc76d741afc67c54b79fb640f0ea466fa142fe5b07424455aa9ee90bcbc1efe5463b511b99aae11c
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04