Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-01-2025 16:15

General

  • Target

    8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

  • Size

    2.3MB

  • MD5

    273744044bbc6e49baffda91a9dd6b38

  • SHA1

    1088749a1051fc3c909959cdcb8c8d6a1d8af316

  • SHA256

    8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50

  • SHA512

    e077864cebcc5305f1f5c7c4d6380a84b6cd304a8fda198609da77d1d19d2bb2298ee3a1861cd8854e10c48f9cf9d44612aa6ea6f98bd82a2bb5645e96683daf

  • SSDEEP

    49152:M09XJt4HIN2H2tFvduySCpEWoxv8nsHyjtk2MYC5GDs:xZJt4HINy2LkCKZxknsmtk2aR

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Detect PurpleFox Rootkit 8 IoCs

    Detect PurpleFox Rootkit.

  • Gh0st RAT payload 8 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Gh0strat family
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • Purplefox family
  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Suspicious Office macro 2 IoCs

    Office document equipped with macros.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
    "C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Users\Admin\AppData\Local\Temp\RVN.exe
      C:\Users\Admin\AppData\Local\Temp\\RVN.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2332
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:1028
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2848
    • C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
      C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2792
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2648
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2024
  • C:\Windows\SysWOW64\TXPlatforn.exe
    C:\Windows\SysWOW64\TXPlatforn.exe -auto
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Windows\SysWOW64\TXPlatforn.exe
      C:\Windows\SysWOW64\TXPlatforn.exe -acsi
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Executes dropped EXE
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      PID:2216
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

    Filesize

    89KB

    MD5

    fd5137d1998bf8fcbab832123dd72256

    SHA1

    155e5dd08ecbe6483167f596c927208f4cca8a39

    SHA256

    86ee28923d4e7255762442fe93f220237197a756182ce320f5f6887b5c7147c5

    SHA512

    fd9270902cec43a84048a0e90ded14e56c9bae46ef067081d10784c82ec1a0ef7dc605b11d8819c9c5d75dea342df8a419bdd61f8ef7411c25fee932038ea465

  • C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

    Filesize

    843KB

    MD5

    db06bd4b57933fb4dd26188ab9a013c7

    SHA1

    24fb49c4fbe2993e96595d1085dbae18d8a73db4

    SHA256

    5d3ccb3cf874eed6dabe680217d17a22096711ddfe184ecb825cf66b46837600

    SHA512

    cd20b5a3abc4b649ae490553e8ef4973a25b77cc6fc669f096928737eec359fdb53e00985314f14f94d3598bebf119ac17c760ece3cb45a0a56bc36c3521a784

  • C:\Users\Admin\AppData\Local\Temp\HD_X.dat

    Filesize

    1.5MB

    MD5

    43a309d76c3bb4a91e3d464b2adb1a70

    SHA1

    d12fc070e16edf51a1dbe8621fd3e1b2c4be60d3

    SHA256

    10801369a0b307d0b9abf07dab6a92263b7c66fa6fc66bb6d0c86260d2fba649

    SHA512

    6925d0cc83c2d8ca52fa58d49d98e94b667ec68d6e2de68d6bf3f3a406bc027a2db7f1aa3e5f4b13c84503d488b9d7392fcaf61e548dc27ddb102e45d327b9c4

  • C:\Users\Admin\AppData\Local\Temp\b4mP55Uq.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\b4mP55Uq.xlsm

    Filesize

    23KB

    MD5

    e0f32187d0953c2cfdb20face00e91bf

    SHA1

    adb5a045eb8f1a9c03bde867d69aedf63e488638

    SHA256

    931f48588d24f62975d0bfe7e7d1f15d5bf67a1f84deaac1eb7436ae75f2f600

    SHA512

    7ba2d1e43e391d362c29705171c30cc4340b2b6a1cb5f4039d6239518966af5a75029914d46ba6a131e9f4fe9f6e78ff680c86f71cfd2adaeb41f4fa8f7e5b02

  • C:\Users\Admin\AppData\Local\Temp\b4mP55Uq.xlsm

    Filesize

    26KB

    MD5

    666578c564e1315b575e2d24ea94a141

    SHA1

    8f97dca5a7532a5dd32ae6a2f3cc61f6399162fc

    SHA256

    be5b9f0e4e7853c18ed8724283187da9648f797b95f1a95ba74c4ae4b87d648f

    SHA512

    665b8761943066c0fcfd8dc78be8eead672d2716f2f9e936468d942405af600226c82ef6d634959dd2db55a6ba175e080ab7028325e5c82c346ffbff80cd8c6b

  • C:\Users\Admin\AppData\Local\Temp\b4mP55Uq.xlsm

    Filesize

    28KB

    MD5

    c25c993b44d8e4325fa10daceab563bc

    SHA1

    6e2199526e04433edefe9db41563fc5ead4d43d6

    SHA256

    62a4cc9bbc7aee09d02e1ad29a6efbb219a2d7076e2df49d4eaf0efbbf4157f9

    SHA512

    3c967584a1090613b2dfa273343c45ffc2488a2c2bd897421b95e7e332d6e4658e5c23fdfcd22803473144e7b7ad4511e7bddbcab2256139668415961f4a4976

  • C:\Users\Admin\AppData\Local\Temp\b4mP55Uq.xlsm

    Filesize

    26KB

    MD5

    ce61b4f2be3bd15d73410170c5b8dfc4

    SHA1

    f4ce0290d5b79507800a50f804ee7507d2390eb8

    SHA256

    7136d686ccc80986e18d284599cef80c5e633d95df3629f233d36f4b69b942b2

    SHA512

    fe81bfa7c3d6e5b45f1c30d835d60d67a38defa915d6a54023fa0cd21d0fd27774fac7085d9e2ca768ad7c962601afc40e04bb29c357f7c6ebf914f9e89906f4

  • C:\Users\Admin\AppData\Local\Temp\~$b4mP55Uq.xlsm

    Filesize

    165B

    MD5

    ff09371174f7c701e75f357a187c06e8

    SHA1

    57f9a638fd652922d7eb23236c80055a91724503

    SHA256

    e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

    SHA512

    e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

  • \Users\Admin\AppData\Local\Temp\RVN.exe

    Filesize

    377KB

    MD5

    80ade1893dec9cab7f2e63538a464fcc

    SHA1

    c06614da33a65eddb506db00a124a3fc3f5be02e

    SHA256

    57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

    SHA512

    fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

  • memory/2216-76-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/2216-72-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/2216-77-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/2312-18-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/2312-60-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/2332-21-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/2332-9-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/2332-7-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/2332-5-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/2648-239-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2648-197-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2648-191-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2672-103-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2948-114-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2948-190-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB