Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2025, 19:13
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
General
-
Target
file.exe
-
Size
1.5MB
-
MD5
2756afc3782b185d3c05dd880a8e8313
-
SHA1
82417bd86f1fb249e296bb6b073b560e47639dde
-
SHA256
f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682
-
SHA512
9ffea594cd493cbd6fcb9f6f63dffa9127b17487177e63a466b786bc2d24d8af270c56dc653720266e6ad410ddce0931423354b6fa2dc02a7b2cb91e42321fc2
-
SSDEEP
24576:WnsJ39LyjbJkQFMhmC+6GD9+wfLrvi4cRIyDe3SUNaXy+WypoGHgQ:WnsHyjtk2MYC5GDf+i3DsX1WH5Q
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 1220 ._cache_file.exe 3192 Synaptics.exe 4588 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" file.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\SysWOW64\OpenAL32.new ._cache_Synaptics.exe File opened for modification C:\Windows\SysWOW64\tmpA9DE.tmp ._cache_file.exe File opened for modification C:\Windows\SysWOW64\tmp91A2.tmp ._cache_Synaptics.exe File opened for modification C:\Windows\SysWOW64\tmp91A1.tmp ._cache_file.exe File opened for modification C:\Windows\system32\OpenAL32.new ._cache_Synaptics.exe File created C:\Windows\system32\OpenAL32.new ._cache_file.exe File opened for modification C:\Windows\system32\wrap_oal.new ._cache_file.exe File created C:\Windows\SysWOW64\OpenAL32.new ._cache_file.exe File created C:\Windows\SysWOW64\wrap_oal.new ._cache_file.exe File created C:\Windows\system32\wrap_oal.new ._cache_Synaptics.exe File opened for modification C:\Windows\SysWOW64\tmpA9DE.tmp ._cache_Synaptics.exe File opened for modification C:\Windows\SysWOW64\tmpA9DF.tmp ._cache_Synaptics.exe File opened for modification C:\Windows\SysWOW64\tmpA9DF.tmp ._cache_file.exe File opened for modification C:\Windows\SysWOW64\tmp91A1.tmp ._cache_Synaptics.exe File opened for modification C:\Windows\SysWOW64\tmp91A2.tmp ._cache_file.exe File created C:\Windows\SysWOW64\wrap_oal.new ._cache_Synaptics.exe File created C:\Windows\system32\wrap_oal.new ._cache_file.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\OpenAL\._cache_file.exe ._cache_file.exe File created C:\Program Files (x86)\OpenAL\._cache_Synaptics.exe ._cache_Synaptics.exe File opened for modification C:\Program Files (x86)\OpenAL\._cache_file.exe ._cache_file.exe File opened for modification C:\Program Files (x86)\OpenAL\._cache_Synaptics.exe ._cache_Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ file.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3156 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3156 EXCEL.EXE 3156 EXCEL.EXE 3156 EXCEL.EXE 3156 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1388 wrote to memory of 1220 1388 file.exe 83 PID 1388 wrote to memory of 1220 1388 file.exe 83 PID 1388 wrote to memory of 1220 1388 file.exe 83 PID 1388 wrote to memory of 3192 1388 file.exe 84 PID 1388 wrote to memory of 3192 1388 file.exe 84 PID 1388 wrote to memory of 3192 1388 file.exe 84 PID 3192 wrote to memory of 4588 3192 Synaptics.exe 85 PID 3192 wrote to memory of 4588 3192 Synaptics.exe 85 PID 3192 wrote to memory of 4588 3192 Synaptics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\._cache_file.exe"C:\Users\Admin\AppData\Local\Temp\._cache_file.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1220
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4588
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3156
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD52756afc3782b185d3c05dd880a8e8313
SHA182417bd86f1fb249e296bb6b073b560e47639dde
SHA256f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682
SHA5129ffea594cd493cbd6fcb9f6f63dffa9127b17487177e63a466b786bc2d24d8af270c56dc653720266e6ad410ddce0931423354b6fa2dc02a7b2cb91e42321fc2
-
Filesize
790KB
MD5694f54bd227916b89fc3eb1db53f0685
SHA121fdc367291bbef14dac27925cae698d3928eead
SHA256b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
SHA51255bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
106KB
MD5235355a8dd26903e75d5e812ecf50e53
SHA18316319341a0f9054e19e4a7b21df3dc49386fee
SHA2561797d150a2e23af4f390f5c33eb598c6f58d0454011d74941f5316add900bbdd
SHA5125beb9343028790f993d0acb1007fd112b7e2ef6f9fbedfdb62b0140d2bbadf3b6368417ea19edb0bc8674d19418e5784fef4430ce1c329de8e83c304706d39ac
-
Filesize
434KB
MD5d494267bc169604fac5e3679b9a97fed
SHA1c093ce5a4f7dc40f7f604945bd1facfb2c805c4b
SHA256a4e46e6d09c4b0966824a2f6628ebf738e813672692a52a0d63d982e1030ef4f
SHA5127cfcfb570ecfa974054b5285c7d6ad3bccf502866ea70789750c3748394cb0991d1fa6dec9c50a506dbc697953663ec2605277a4451098bb8cd6699c4e506040
-
Filesize
120KB
MD52ad7b4f3c8d2bb686d231edff404b7a4
SHA1f29676b96d04bd2765925a3834d9babfdce6a0b3
SHA25687802322c8e63555c26fe473ce234ce7099745ccb28c02766c2224c726454039
SHA51251a6c8cfe30e34c37437e6c5f8c602aa0759b65559a82521e2dbcf8a9865b826077854acb6497df6085d67b4c66083ae5f0f192b743a4b6f77ce7b18f01bf528
-
Filesize
455KB
MD5549347bcd4aacd63243d78e8f869dbb1
SHA1efc00d2a7c5acfe17b8a58023826e6840aef39a6
SHA2565379373cf3eff41cdd8c912c65e27e1bd492bd84238d19a093aa846c9b1ce909
SHA512c6789376d05deb8c5050225c37c023055c107a72b49afddfd3f91e7e7429d38db9346e2e5d38986c2000c3828389cfbe5d74d80423a79eebd0367bcc81137cd5