Analysis
-
max time kernel
112s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08-01-2025 21:38
Behavioral task
behavioral1
Sample
caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe
Resource
win10v2004-20241007-en
General
-
Target
caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe
-
Size
1011KB
-
MD5
6fdfd2a6d0b7c47759b00d7dd25e5940
-
SHA1
596de87c84b76dc067f41857ac4e54dffb23a4fc
-
SHA256
caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489d
-
SHA512
cc5cd25fdf4f4a109b10cf09ca6bd8e23916a4cba4c6103afce355ccc25f5b49f8a4a7b03f77abc5302f697552501651911f174c6d4892820c4d1225a9d36ae5
-
SSDEEP
24576:KnsJ39LyjbJkQFMhmC+6GD9ATuoIK4PVXWr:KnsHyjtk2MYC5GDyTuo2Pd4
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
pid Process 2272 ._cache_caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 2896 Synaptics.exe 2924 ._cache_Synaptics.exe -
Loads dropped DLL 5 IoCs
pid Process 576 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 576 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 576 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 2896 Synaptics.exe 2896 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2356 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2356 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 576 wrote to memory of 2272 576 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 30 PID 576 wrote to memory of 2272 576 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 30 PID 576 wrote to memory of 2272 576 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 30 PID 576 wrote to memory of 2272 576 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 30 PID 576 wrote to memory of 2896 576 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 32 PID 576 wrote to memory of 2896 576 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 32 PID 576 wrote to memory of 2896 576 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 32 PID 576 wrote to memory of 2896 576 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 32 PID 2896 wrote to memory of 2924 2896 Synaptics.exe 33 PID 2896 wrote to memory of 2924 2896 Synaptics.exe 33 PID 2896 wrote to memory of 2924 2896 Synaptics.exe 33 PID 2896 wrote to memory of 2924 2896 Synaptics.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe"C:\Users\Admin\AppData\Local\Temp\caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\._cache_caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe"C:\Users\Admin\AppData\Local\Temp\._cache_caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2272
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2924
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1011KB
MD56fdfd2a6d0b7c47759b00d7dd25e5940
SHA1596de87c84b76dc067f41857ac4e54dffb23a4fc
SHA256caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489d
SHA512cc5cd25fdf4f4a109b10cf09ca6bd8e23916a4cba4c6103afce355ccc25f5b49f8a4a7b03f77abc5302f697552501651911f174c6d4892820c4d1225a9d36ae5
-
Filesize
17KB
MD5af4d37aad8b34471da588360a43e768a
SHA183ed64667d4e68ea531b8bcf58aab3ed4a5ca998
SHA256e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1
SHA51274f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da
-
\Users\Admin\AppData\Local\Temp\._cache_caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe
Filesize258KB
MD5911218ad9b6d8a0d54a14711d3bf464f
SHA1f72de5880ae3ed30eabd8618c5ca3106df3cbdcc
SHA256bf9256c1c62f6e7733479cd60c9c8ef24d41ce32a59f2840d77e971b24edd6dd
SHA5129a1e2c2d07adc0b0945e2542d43de256fc6791559d28bacd4684087a60b466fe730852459f0f04bdde187523568cac002334df3fb05a84e9175344ccbb288874