Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/01/2025, 19:21
Behavioral task
behavioral1
Sample
N0RIH_file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
N0RIH_file.exe
Resource
win10v2004-20241007-en
General
-
Target
N0RIH_file.exe
-
Size
15.0MB
-
MD5
7e33585d157419e39fb4d232c9f0c5dc
-
SHA1
1cf4864a9b009e12534cc299c14466f2b2c9cea3
-
SHA256
027a4baf9864a23fe09d99be3a6f83d1841e47aac2f94d313d2580e84d1b1b39
-
SHA512
3abcb07cdde6d8014149e5ad9c07f1afaa88d4a8fb85a67e6f0514ec613ada145dda81713dd96ba0a91f056d65919820b24c6bf2232d59e7fdc6d27f86b01036
-
SSDEEP
393216:EU5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDvD:v7pttD7yBG/uljIinXj0fX
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 5 IoCs
pid Process 2676 ._cache_N0RIH_file.exe 2804 Synaptics.exe 2716 ._cache_N0RIH_file.exe 1936 ._cache_Synaptics.exe 1588 ._cache_Synaptics.exe -
Loads dropped DLL 9 IoCs
pid Process 2696 N0RIH_file.exe 2696 N0RIH_file.exe 2696 N0RIH_file.exe 2676 ._cache_N0RIH_file.exe 2804 Synaptics.exe 2804 Synaptics.exe 2716 ._cache_N0RIH_file.exe 1936 ._cache_Synaptics.exe 1588 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" N0RIH_file.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_N0RIH_file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N0RIH_file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_N0RIH_file.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 580 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 580 EXCEL.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2676 2696 N0RIH_file.exe 30 PID 2696 wrote to memory of 2676 2696 N0RIH_file.exe 30 PID 2696 wrote to memory of 2676 2696 N0RIH_file.exe 30 PID 2696 wrote to memory of 2676 2696 N0RIH_file.exe 30 PID 2696 wrote to memory of 2676 2696 N0RIH_file.exe 30 PID 2696 wrote to memory of 2676 2696 N0RIH_file.exe 30 PID 2696 wrote to memory of 2676 2696 N0RIH_file.exe 30 PID 2696 wrote to memory of 2804 2696 N0RIH_file.exe 31 PID 2696 wrote to memory of 2804 2696 N0RIH_file.exe 31 PID 2696 wrote to memory of 2804 2696 N0RIH_file.exe 31 PID 2696 wrote to memory of 2804 2696 N0RIH_file.exe 31 PID 2676 wrote to memory of 2716 2676 ._cache_N0RIH_file.exe 32 PID 2676 wrote to memory of 2716 2676 ._cache_N0RIH_file.exe 32 PID 2676 wrote to memory of 2716 2676 ._cache_N0RIH_file.exe 32 PID 2676 wrote to memory of 2716 2676 ._cache_N0RIH_file.exe 32 PID 2676 wrote to memory of 2716 2676 ._cache_N0RIH_file.exe 32 PID 2676 wrote to memory of 2716 2676 ._cache_N0RIH_file.exe 32 PID 2676 wrote to memory of 2716 2676 ._cache_N0RIH_file.exe 32 PID 2804 wrote to memory of 1936 2804 Synaptics.exe 33 PID 2804 wrote to memory of 1936 2804 Synaptics.exe 33 PID 2804 wrote to memory of 1936 2804 Synaptics.exe 33 PID 2804 wrote to memory of 1936 2804 Synaptics.exe 33 PID 2804 wrote to memory of 1936 2804 Synaptics.exe 33 PID 2804 wrote to memory of 1936 2804 Synaptics.exe 33 PID 2804 wrote to memory of 1936 2804 Synaptics.exe 33 PID 1936 wrote to memory of 1588 1936 ._cache_Synaptics.exe 35 PID 1936 wrote to memory of 1588 1936 ._cache_Synaptics.exe 35 PID 1936 wrote to memory of 1588 1936 ._cache_Synaptics.exe 35 PID 1936 wrote to memory of 1588 1936 ._cache_Synaptics.exe 35 PID 1936 wrote to memory of 1588 1936 ._cache_Synaptics.exe 35 PID 1936 wrote to memory of 1588 1936 ._cache_Synaptics.exe 35 PID 1936 wrote to memory of 1588 1936 ._cache_Synaptics.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\N0RIH_file.exe"C:\Users\Admin\AppData\Local\Temp\N0RIH_file.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\._cache_N0RIH_file.exe"C:\Users\Admin\AppData\Local\Temp\._cache_N0RIH_file.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\Temp\{AEA49025-00A4-4FDC-A6B9-CF5503589E6B}\.cr\._cache_N0RIH_file.exe"C:\Windows\Temp\{AEA49025-00A4-4FDC-A6B9-CF5503589E6B}\.cr\._cache_N0RIH_file.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\._cache_N0RIH_file.exe" -burn.filehandle.attached=180 -burn.filehandle.self=1883⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2716
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\Temp\{CDAABF68-320D-4CFC-BC4A-63E91C119AAE}\.cr\._cache_Synaptics.exe"C:\Windows\Temp\{CDAABF68-320D-4CFC-BC4A-63E91C119AAE}\.cr\._cache_Synaptics.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 InjUpdate4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1588
-
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15.0MB
MD57e33585d157419e39fb4d232c9f0c5dc
SHA11cf4864a9b009e12534cc299c14466f2b2c9cea3
SHA256027a4baf9864a23fe09d99be3a6f83d1841e47aac2f94d313d2580e84d1b1b39
SHA5123abcb07cdde6d8014149e5ad9c07f1afaa88d4a8fb85a67e6f0514ec613ada145dda81713dd96ba0a91f056d65919820b24c6bf2232d59e7fdc6d27f86b01036
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
21KB
MD5c77b651fb15b05847cd7712eefcc6d91
SHA1c2e84258be138c125389e649cef9edd3ac2a08b8
SHA256029e342e26360a81adf20df8801aa38e8c4447775f9f4ee3a941e40b11ba4bef
SHA5120dbcb9f578df68c912842610e9d5300d5075196e43f93d5c7801d70cee67b8c0b56a6c95ec9ecf446d19f3d5d66dcda84bcff5d43f0f2cba580fac99a78b7aca
-
Filesize
632KB
MD5843288fd72a1152b50b4e4b7344bb592
SHA1648416c53721a85666abaf71c6682fcc1da70b48
SHA25682c3e3423e48bafcdd726624eb7fd3e00674e50e4b6acdcac408fe8fae43b022
SHA51204b61bb0a6e748ab78b1037db68bc9ec1745bb3efaca0b8fb6d99e01abbe08a67168cbf3f714b72daf00da26084ec6f6f707c3cd08fa8243023e6924719a4e41
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
14.3MB
MD5f0248d477e74687c5619ae16498b13d4
SHA19ed4b091148c9b53f66b3f2c69be7e60e74c486a
SHA256b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
SHA5120c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2