Malware Analysis Report

2025-04-13 21:02

Sample ID 250103-fe312sznds
Target f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
SHA256 f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682
Tags
xred backdoor discovery persistence macro
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682

Threat Level: Known bad

The file f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe was found to be: Known bad.

Malicious Activity Summary

xred backdoor discovery persistence macro

Xred family

Xred

Suspicious Office macro

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry class

Checks processor information in registry

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-03 04:48

Signatures

Xred family

xred

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-03 04:48

Reported

2025-01-03 04:50

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe"

Signatures

Xred

backdoor xred

Xred family

xred

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\tmpE82D.tmp C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File created C:\Windows\SysWOW64\OpenAL32.new C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\SysWOW64\wrap_oal.new C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File created C:\Windows\system32\wrap_oal.new C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File created C:\Windows\SysWOW64\wrap_oal.new C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File created C:\Windows\SysWOW64\OpenAL32.new C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File created C:\Windows\system32\wrap_oal.new C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\SysWOW64\tmp6A.tmp C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\SysWOW64\tmp7B.tmp C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File opened for modification C:\Windows\SysWOW64\tmpE82F.tmp C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File created C:\Windows\SysWOW64\wrap_oal.new C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File opened for modification C:\Windows\system32\OpenAL32.new C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File opened for modification C:\Windows\SysWOW64\tmp6A.tmp C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File opened for modification C:\Windows\SysWOW64\tmpE82E.tmp C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File created C:\Windows\system32\OpenAL32.new C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\SysWOW64\tmp6B.tmp C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\OpenAL\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Program Files (x86)\OpenAL\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File created C:\Program Files (x86)\OpenAL\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File created C:\Program Files (x86)\OpenAL\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2732 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
PID 2732 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
PID 2732 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
PID 2732 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2732 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2732 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 3360 wrote to memory of 2648 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3360 wrote to memory of 2648 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 3360 wrote to memory of 2648 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe

"C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.74.250.142.in-addr.arpa udp

Files

memory/2732-0-0x0000000002420000-0x0000000002421000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe

MD5 694f54bd227916b89fc3eb1db53f0685
SHA1 21fdc367291bbef14dac27925cae698d3928eead
SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5

C:\ProgramData\Synaptics\Synaptics.exe

MD5 2756afc3782b185d3c05dd880a8e8313
SHA1 82417bd86f1fb249e296bb6b073b560e47639dde
SHA256 f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682
SHA512 9ffea594cd493cbd6fcb9f6f63dffa9127b17487177e63a466b786bc2d24d8af270c56dc653720266e6ad410ddce0931423354b6fa2dc02a7b2cb91e42321fc2

memory/2732-128-0x0000000000400000-0x0000000000588000-memory.dmp

memory/3360-129-0x00000000023F0000-0x00000000023F1000-memory.dmp

C:\Windows\SysWOW64\wrap_oal.new

MD5 d494267bc169604fac5e3679b9a97fed
SHA1 c093ce5a4f7dc40f7f604945bd1facfb2c805c4b
SHA256 a4e46e6d09c4b0966824a2f6628ebf738e813672692a52a0d63d982e1030ef4f
SHA512 7cfcfb570ecfa974054b5285c7d6ad3bccf502866ea70789750c3748394cb0991d1fa6dec9c50a506dbc697953663ec2605277a4451098bb8cd6699c4e506040

C:\Windows\system32\OpenAL32.new

MD5 2ad7b4f3c8d2bb686d231edff404b7a4
SHA1 f29676b96d04bd2765925a3834d9babfdce6a0b3
SHA256 87802322c8e63555c26fe473ce234ce7099745ccb28c02766c2224c726454039
SHA512 51a6c8cfe30e34c37437e6c5f8c602aa0759b65559a82521e2dbcf8a9865b826077854acb6497df6085d67b4c66083ae5f0f192b743a4b6f77ce7b18f01bf528

memory/3360-214-0x0000000000400000-0x0000000000588000-memory.dmp

C:\Windows\SysWOW64\OpenAL32.dll

MD5 235355a8dd26903e75d5e812ecf50e53
SHA1 8316319341a0f9054e19e4a7b21df3dc49386fee
SHA256 1797d150a2e23af4f390f5c33eb598c6f58d0454011d74941f5316add900bbdd
SHA512 5beb9343028790f993d0acb1007fd112b7e2ef6f9fbedfdb62b0140d2bbadf3b6368417ea19edb0bc8674d19418e5784fef4430ce1c329de8e83c304706d39ac

C:\Windows\System32\wrap_oal.new

MD5 549347bcd4aacd63243d78e8f869dbb1
SHA1 efc00d2a7c5acfe17b8a58023826e6840aef39a6
SHA256 5379373cf3eff41cdd8c912c65e27e1bd492bd84238d19a093aa846c9b1ce909
SHA512 c6789376d05deb8c5050225c37c023055c107a72b49afddfd3f91e7e7429d38db9346e2e5d38986c2000c3828389cfbe5d74d80423a79eebd0367bcc81137cd5

memory/428-262-0x00007FFE98890000-0x00007FFE988A0000-memory.dmp

memory/428-263-0x00007FFE98890000-0x00007FFE988A0000-memory.dmp

memory/428-264-0x00007FFE98890000-0x00007FFE988A0000-memory.dmp

memory/428-265-0x00007FFE98890000-0x00007FFE988A0000-memory.dmp

memory/428-266-0x00007FFE98890000-0x00007FFE988A0000-memory.dmp

memory/428-267-0x00007FFE96650000-0x00007FFE96660000-memory.dmp

memory/428-268-0x00007FFE96650000-0x00007FFE96660000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\y8wcIP9Q.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\37085E00

MD5 14f360d5e7e251bb01ef34c7e748c8a7
SHA1 d72838e638feae422ca8bf56e9bb99d8d0aad71f
SHA256 00f3e389b491ef2b21e8e21913d1025ca30625630411a158c29a906fadcc5b5c
SHA512 2223f489ba652cc604fec52da4d1def82bb4f1fe6a59b8461d78e6b8c96860b04bb0dd9898f11e67830fcdfb9f395c6df5b6ab86b33669d601bbd500f1aaea6b

memory/3360-315-0x0000000000400000-0x0000000000588000-memory.dmp

memory/3360-346-0x0000000000400000-0x0000000000588000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-03 04:48

Reported

2025-01-03 04:50

Platform

win7-20240903-en

Max time kernel

141s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe"

Signatures

Xred

backdoor xred

Xred family

xred

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\wrap_oal.new C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File opened for modification C:\Windows\SysWOW64\wrap_oal.new C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File created C:\Windows\SysWOW64\wrap_oal.new C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\system32\wrap_oal.new C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\SysWOW64\tmp416.tmp C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\system32\OpenAL32.new C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\SysWOW64\wrap_oal.new C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\SysWOW64\OpenAL32.new C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File created C:\Windows\system32\OpenAL32.new C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File created C:\Windows\system32\OpenAL32.new C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File created C:\Windows\system32\wrap_oal.new C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\SysWOW64\tmp1C78.tmp C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File opened for modification C:\Windows\SysWOW64\tmp1C7A.tmp C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File opened for modification C:\Windows\SysWOW64\OpenAL32.new C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File opened for modification C:\Windows\SysWOW64\tmp447.tmp C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\SysWOW64\tmp446.tmp C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File created C:\Windows\SysWOW64\OpenAL32.new C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File created C:\Windows\SysWOW64\wrap_oal.new C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File opened for modification C:\Windows\SysWOW64\tmp1C79.tmp C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\system32\OpenAL32.new C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File opened for modification C:\Windows\SysWOW64\tmp417.tmp C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\OpenAL\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File created C:\Program Files (x86)\OpenAL\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
File created C:\Program Files (x86)\OpenAL\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Program Files (x86)\OpenAL\._cache_Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2224 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
PID 2224 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
PID 2224 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
PID 2224 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
PID 2224 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
PID 2224 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
PID 2224 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
PID 2224 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2224 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2224 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2224 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2172 wrote to memory of 2660 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2172 wrote to memory of 2660 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2172 wrote to memory of 2660 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2172 wrote to memory of 2660 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2172 wrote to memory of 2660 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2172 wrote to memory of 2660 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2172 wrote to memory of 2660 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe

"C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 88.221.134.83:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp

Files

memory/2224-0-0x0000000000220000-0x0000000000221000-memory.dmp

\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe

MD5 694f54bd227916b89fc3eb1db53f0685
SHA1 21fdc367291bbef14dac27925cae698d3928eead
SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5

C:\ProgramData\Synaptics\Synaptics.exe

MD5 2756afc3782b185d3c05dd880a8e8313
SHA1 82417bd86f1fb249e296bb6b073b560e47639dde
SHA256 f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682
SHA512 9ffea594cd493cbd6fcb9f6f63dffa9127b17487177e63a466b786bc2d24d8af270c56dc653720266e6ad410ddce0931423354b6fa2dc02a7b2cb91e42321fc2

memory/2224-25-0x0000000000400000-0x0000000000588000-memory.dmp

memory/2560-35-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\PdyZTJVN.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

C:\Users\Admin\AppData\Local\Temp\PdyZTJVN.xlsm

MD5 6ab00cd80470d549c06715b46c934ba9
SHA1 4370c83a63c106949758687dc7bfe6541a652d50
SHA256 bf7dfebbcfda8cb31738a2b1e99d6f382a6a6752a92fc0d28073a636e93121f5
SHA512 d2468ad178c3565a17bf6651ea869552371824165e8e9a53be50f15a672132fdd3cea40a520c353fac4534a0caf69b0a433184c07a12917d3fde49d017e7ec95

C:\Users\Admin\AppData\Local\Temp\PdyZTJVN.xlsm

MD5 a714b8c5a03851735238b4cdd75cafe0
SHA1 60785776b49eb25c5bd1fcbec5e9340f85f85907
SHA256 2930b9cd46cb6e58000b7b2f0b3fb23e849ccbde8037f610b4a8925fc101af5c
SHA512 1281691c12ea401500520147a57b4dafb212a63a44dba3da9bf0836249d50d822c3074436d4f7db6b8a8fa2bff329211481b67db4e81f1a89f7ada8bff3c9112

C:\Users\Admin\AppData\Local\Temp\PdyZTJVN.xlsm

MD5 868a821a705f02b22543ec0bcde7b23d
SHA1 74a6222c1361c8f65138a4a8d13c6dedd46d381a
SHA256 100a6447f6d3d03c276d8c968822ad937172ca163a87adc9ed81610279329b52
SHA512 71d939a69eedb86e7b752193779a1d65537374580207d39517fef271cbc61c6917d3ffbf392e5204570e959fda1fcc696e33901de9e6d9839df87690dcbd1c68

C:\Users\Admin\AppData\Local\Temp\PdyZTJVN.xlsm

MD5 c02dcf85814f134f16a84ba250684ae0
SHA1 5e47701709b25d94ee4274e1ffde780bfe5999a1
SHA256 b46b85d3de0e2af70ac3f4b91bb6dd83988bf6103f4975c2254003ec4647796f
SHA512 572e7c419b7043cf57a1dfa3609db72190a6f37fdcc1e7633b9dda4f67c18b6ee728325cfc85119cc5fdb3b2f98f771845f427b1364ff66ba4cd3c86c44a0f85

C:\Users\Admin\Documents\~$UsePush.xlsx

MD5 ff09371174f7c701e75f357a187c06e8
SHA1 57f9a638fd652922d7eb23236c80055a91724503
SHA256 e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512 e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

\Windows\SysWOW64\OpenAL32.new

MD5 235355a8dd26903e75d5e812ecf50e53
SHA1 8316319341a0f9054e19e4a7b21df3dc49386fee
SHA256 1797d150a2e23af4f390f5c33eb598c6f58d0454011d74941f5316add900bbdd
SHA512 5beb9343028790f993d0acb1007fd112b7e2ef6f9fbedfdb62b0140d2bbadf3b6368417ea19edb0bc8674d19418e5784fef4430ce1c329de8e83c304706d39ac

\Windows\System32\OpenAL32.new

MD5 2ad7b4f3c8d2bb686d231edff404b7a4
SHA1 f29676b96d04bd2765925a3834d9babfdce6a0b3
SHA256 87802322c8e63555c26fe473ce234ce7099745ccb28c02766c2224c726454039
SHA512 51a6c8cfe30e34c37437e6c5f8c602aa0759b65559a82521e2dbcf8a9865b826077854acb6497df6085d67b4c66083ae5f0f192b743a4b6f77ce7b18f01bf528

\Windows\SysWOW64\wrap_oal.new

MD5 d494267bc169604fac5e3679b9a97fed
SHA1 c093ce5a4f7dc40f7f604945bd1facfb2c805c4b
SHA256 a4e46e6d09c4b0966824a2f6628ebf738e813672692a52a0d63d982e1030ef4f
SHA512 7cfcfb570ecfa974054b5285c7d6ad3bccf502866ea70789750c3748394cb0991d1fa6dec9c50a506dbc697953663ec2605277a4451098bb8cd6699c4e506040

\Windows\System32\wrap_oal.new

MD5 549347bcd4aacd63243d78e8f869dbb1
SHA1 efc00d2a7c5acfe17b8a58023826e6840aef39a6
SHA256 5379373cf3eff41cdd8c912c65e27e1bd492bd84238d19a093aa846c9b1ce909
SHA512 c6789376d05deb8c5050225c37c023055c107a72b49afddfd3f91e7e7429d38db9346e2e5d38986c2000c3828389cfbe5d74d80423a79eebd0367bcc81137cd5

memory/2172-146-0x0000000000400000-0x0000000000588000-memory.dmp

C:\Windows\SysWOW64\wrap_oal.new

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2172-228-0x0000000000400000-0x0000000000588000-memory.dmp