Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-01-2025 03:34
Behavioral task
behavioral1
Sample
45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe
Resource
win10v2004-20241007-en
General
-
Target
45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe
-
Size
759KB
-
MD5
f942e3805f405407247d09a99145966f
-
SHA1
8660e9f35751c8ad24c7be53a77b2a2318d6eba4
-
SHA256
45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176
-
SHA512
a03d6953f0077f17a766c32dfb1d75747108d401a34458dec59858f3bfacd6fde92fe174faff82937fb3578b15603f4899c1039a766495be40d9f1ab62dacc45
-
SSDEEP
12288:SMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9YQh:SnsJ39LyjbJkQFMhmC+6GD99
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
resource behavioral1/files/0x0007000000015f4e-93.dat -
Executes dropped EXE 3 IoCs
pid Process 2820 ._cache_45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 2792 Synaptics.exe 2208 ._cache_Synaptics.exe -
Loads dropped DLL 11 IoCs
pid Process 2316 45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 2316 45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 2316 45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 2716 dw20.exe 2716 dw20.exe 2716 dw20.exe 2792 Synaptics.exe 2792 Synaptics.exe 1784 dw20.exe 1784 dw20.exe 1784 dw20.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2188 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2188 EXCEL.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2820 2316 45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 30 PID 2316 wrote to memory of 2820 2316 45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 30 PID 2316 wrote to memory of 2820 2316 45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 30 PID 2316 wrote to memory of 2820 2316 45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 30 PID 2316 wrote to memory of 2792 2316 45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 32 PID 2316 wrote to memory of 2792 2316 45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 32 PID 2316 wrote to memory of 2792 2316 45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 32 PID 2316 wrote to memory of 2792 2316 45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 32 PID 2820 wrote to memory of 2716 2820 ._cache_45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 33 PID 2820 wrote to memory of 2716 2820 ._cache_45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 33 PID 2820 wrote to memory of 2716 2820 ._cache_45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 33 PID 2820 wrote to memory of 2716 2820 ._cache_45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe 33 PID 2792 wrote to memory of 2208 2792 Synaptics.exe 34 PID 2792 wrote to memory of 2208 2792 Synaptics.exe 34 PID 2792 wrote to memory of 2208 2792 Synaptics.exe 34 PID 2792 wrote to memory of 2208 2792 Synaptics.exe 34 PID 2208 wrote to memory of 1784 2208 ._cache_Synaptics.exe 37 PID 2208 wrote to memory of 1784 2208 ._cache_Synaptics.exe 37 PID 2208 wrote to memory of 1784 2208 ._cache_Synaptics.exe 37 PID 2208 wrote to memory of 1784 2208 ._cache_Synaptics.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe"C:\Users\Admin\AppData\Local\Temp\45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\._cache_45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe"C:\Users\Admin\AppData\Local\Temp\._cache_45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 3963⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2716
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 3884⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1784
-
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
759KB
MD5f942e3805f405407247d09a99145966f
SHA18660e9f35751c8ad24c7be53a77b2a2318d6eba4
SHA25645f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176
SHA512a03d6953f0077f17a766c32dfb1d75747108d401a34458dec59858f3bfacd6fde92fe174faff82937fb3578b15603f4899c1039a766495be40d9f1ab62dacc45
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
24KB
MD5089491de37bf26013fc6219dcca0a7f5
SHA1f2bb246d990926bdb485e58736efdd138f339036
SHA256d210662c2830ad2d86e7601d35dd15fba8df9586908194adcebd398e0897cc49
SHA51275e2ca5147c4003997ca8c81ab117f336843017dd2f11ea40d621ac4c19239f3b925e42a54227903f8d01ba68d48b98c9caf8617a0f33c0aea19dded9d3852f5
-
Filesize
23KB
MD527047eea9a62dca9b26301b7224896a6
SHA19a0aa88f729f1ae99a03d31242601b2a7abf0ed7
SHA25661b07c5b3a74f83220a5a03805caf059e24b0a61a7811782a8dd1d7bc7f57045
SHA5125f5b81caa696db8d5b6dd2b4c56e65df09fd2fa0def53472d70e19a96d74a275d82ebd3d4b66705ed6a7e73a4585adff76e0ac4c11014f55ea52ab5569ef5d42
-
Filesize
26KB
MD5831659cb6a1cd3bf9280656de1d43ce2
SHA14bccaab2cfff88410c83d506f5576f9c16364203
SHA256e69289f7b3d95bb52c8943eb1359d707363a5ee5b56f7f8759f9d1dc391954dd
SHA512eb27b41660f53d112448c1fc347e00dd539c5fcd09cae4558ebbeedf3911aabeb0316a9d907919100fddc2ed9c438a2646c00d40b35990e0d1f989cd872cec98
-
\Users\Admin\AppData\Local\Temp\._cache_45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe
Filesize5KB
MD57cf8491bc5ac58184cd684d1a088340a
SHA1ba61e1cad1c0187933213843001f75e2bb0259a9
SHA2567d261f5c5051519a5c0cf53e21e095e7e6984b16fa8929f0edbe8213f8441f8f
SHA512c42c355560ab5343f53ca46c50e3ae1803301920a5ce6d3ce991c457c8753595cb21bdfa1be205191eb4fef290bed15feaf0c3d16f0c040abed05f41d9a97d1b