Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/01/2025, 23:51
Behavioral task
behavioral1
Sample
847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe
Resource
win10v2004-20241007-en
General
-
Target
847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe
-
Size
1.0MB
-
MD5
bca24f8383fb85906be2f95130d7fef0
-
SHA1
39f49533e336023ff816166e89c78da05f9cf6de
-
SHA256
847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5
-
SHA512
872eac9e1b485207a6237f4ef541ea276ddbd09c933d1089c7b2b7e114f405aa14af39ddd0154c88edde94001b61da39df942396c8d60b63e3aea7c69c173473
-
SSDEEP
24576:XnsJ39LyjbJkQFMhmC+6GD9cR/EBXaSmE:XnsHyjtk2MYC5GDoPE
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
pid Process 2316 ._cache_847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe 2820 Synaptics.exe 2628 ._cache_Synaptics.exe -
Loads dropped DLL 7 IoCs
pid Process 2796 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe 2796 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe 2796 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe 2796 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe 2820 Synaptics.exe 2820 Synaptics.exe 2820 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2016 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2016 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2316 2796 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe 31 PID 2796 wrote to memory of 2316 2796 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe 31 PID 2796 wrote to memory of 2316 2796 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe 31 PID 2796 wrote to memory of 2316 2796 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe 31 PID 2796 wrote to memory of 2820 2796 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe 32 PID 2796 wrote to memory of 2820 2796 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe 32 PID 2796 wrote to memory of 2820 2796 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe 32 PID 2796 wrote to memory of 2820 2796 847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe 32 PID 2820 wrote to memory of 2628 2820 Synaptics.exe 33 PID 2820 wrote to memory of 2628 2820 Synaptics.exe 33 PID 2820 wrote to memory of 2628 2820 Synaptics.exe 33 PID 2820 wrote to memory of 2628 2820 Synaptics.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe"C:\Users\Admin\AppData\Local\Temp\847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\._cache_847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe"2⤵
- Executes dropped EXE
PID:2316
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:2628
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5bca24f8383fb85906be2f95130d7fef0
SHA139f49533e336023ff816166e89c78da05f9cf6de
SHA256847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5
SHA512872eac9e1b485207a6237f4ef541ea276ddbd09c933d1089c7b2b7e114f405aa14af39ddd0154c88edde94001b61da39df942396c8d60b63e3aea7c69c173473
-
C:\Users\Admin\AppData\Local\Temp\._cache_847c4ea89b4e4d803d0d779e99bff4ae85af66ea7c5539577eb0868962e0acf5N.exe
Filesize309KB
MD5920d7a68ed6e9e978151100b2b0218b7
SHA12a1249ad65a95fd3cbd3a8acc74d580114ebb25d
SHA256ec9476e2e5cfc33184055e3cac23b5fa6658700e990f382cdacb189d35f8533b
SHA51228c75ea4310c5106afe0bfb588dea7b1145df49ec47286b56b8fc240681c6ea5679998ebb3e545cb74085988b92af5ea9f40d6fdbe25270ed40abc52970cf659
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04