Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

4bee0b05fc...23.exe

windows7-x64

10

4bee0b05fc...23.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2025, 02:43 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4bee0b05fcd9e9a15a04361b6f80bba1cd740c69f40f208ec0d4eba6e38acf23.exe

  • Size

    2.6MB

  • MD5

    e050b1291c50f809e006b88704d7ed8c

  • SHA1

    522e3d809aad8aece282dd7769f9df7608c4081a

  • SHA256

    4bee0b05fcd9e9a15a04361b6f80bba1cd740c69f40f208ec0d4eba6e38acf23

  • SHA512

    d3e6edfc917e325eaea94e8f884b417279d5b56ef77d8462a606a0d35a8cdc160c821f4b6cab0ae86655ccf822e1729e6ead562b03cbb8184330ba676d53f291

  • SSDEEP

    49152:8nsHyjtk2MYC5GDb+qZOTucfV5kLgH2igj13:8nsmtk2aRqZ7gvMZ

Score
10/10
xredbackdoordiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    xredline1@gmail.com

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bee0b05fcd9e9a15a04361b6f80bba1cd740c69f40f208ec0d4eba6e38acf23.exe
    "C:\Users\Admin\AppData\Local\Temp\4bee0b05fcd9e9a15a04361b6f80bba1cd740c69f40f208ec0d4eba6e38acf23.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Users\Admin\AppData\Local\Temp\._cache_4bee0b05fcd9e9a15a04361b6f80bba1cd740c69f40f208ec0d4eba6e38acf23.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_4bee0b05fcd9e9a15a04361b6f80bba1cd740c69f40f208ec0d4eba6e38acf23.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3504
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2436
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:736

Network

  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    40.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    40.134.221.88.in-addr.arpa
    IN PTR
    Response
    40.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-40deploystaticakamaitechnologiescom
  • flag-us
    DNS
    71.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    245.231.24.184.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    245.231.24.184.in-addr.arpa
    IN PTR
    Response
    245.231.24.184.in-addr.arpa
    IN PTR
    a184-24-231-245deploystaticakamaitechnologiescom
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    46.28.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    46.28.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    xred.mooo.com
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    xred.mooo.com
    IN A
    Response
  • flag-us
    DNS
    freedns.afraid.org
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    freedns.afraid.org
    IN A
    Response
    freedns.afraid.org
    IN A
    69.42.215.252
  • flag-us
    GET
    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
    Synaptics.exe
    Remote address:
    69.42.215.252:80
    Request
    GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1
    User-Agent: MyApp
    Host: freedns.afraid.org
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Fri, 24 Jan 2025 02:43:50 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Vary: Accept-Encoding
    X-Cache: MISS
  • flag-us
    DNS
    252.215.42.69.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    252.215.42.69.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    252.215.42.69.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    252.215.42.69.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    16.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    16.173.189.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    244.160.67.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    244.160.67.23.in-addr.arpa
    IN PTR
    Response
    244.160.67.23.in-addr.arpa
    IN PTR
    a23-67-160-244deploystaticakamaitechnologiescom
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    docs.google.com
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    docs.google.com
    IN A
    Response
    docs.google.com
    IN A
    216.58.212.206
  • flag-gb
    GET
    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    216.58.212.206:443
    Request
    GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Host: docs.google.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 303 See Other
    Content-Type: application/binary
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Fri, 24 Jan 2025 02:44:50 GMT
    Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Strict-Transport-Security: max-age=31536000
    Cross-Origin-Opener-Policy: same-origin
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Content-Security-Policy: script-src 'report-sample' 'nonce-41p1V3bvTIdQAZueYVUrPg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
    Server: ESF
    Content-Length: 0
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-gb
    GET
    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    216.58.212.206:443
    Request
    GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Host: docs.google.com
    Cache-Control: no-cache
    Cookie: NID=520=CQk71hPshoK-_fRsPR2rupXwGSln5gFoIO3KnBt__X2dSiS8YvpfTqwmm6hqr3T6bk9VYsF6p-JBpTsXo6YM9oWwF_-H3LSwFTb6CKXKWj5QT92mjCQg5m-2l2sUJg575LbxQIu6OeP61WMFhJcusqnkRdAf6qKuXL6NCWCqk2fytqhYCllkzjx-
    Response
    HTTP/1.1 303 See Other
    Content-Type: application/binary
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Fri, 24 Jan 2025 02:44:50 GMT
    Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Strict-Transport-Security: max-age=31536000
    Content-Security-Policy: script-src 'report-sample' 'nonce-QX0GCNZqxymTyDkrafrXqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Cross-Origin-Opener-Policy: same-origin
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
    Server: ESF
    Content-Length: 0
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-gb
    GET
    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    216.58.212.206:443
    Request
    GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Host: docs.google.com
    Cache-Control: no-cache
    Cookie: NID=520=CQk71hPshoK-_fRsPR2rupXwGSln5gFoIO3KnBt__X2dSiS8YvpfTqwmm6hqr3T6bk9VYsF6p-JBpTsXo6YM9oWwF_-H3LSwFTb6CKXKWj5QT92mjCQg5m-2l2sUJg575LbxQIu6OeP61WMFhJcusqnkRdAf6qKuXL6NCWCqk2fytqhYCllkzjx-
    Response
    HTTP/1.1 303 See Other
    Content-Type: application/binary
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Fri, 24 Jan 2025 02:44:50 GMT
    Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Strict-Transport-Security: max-age=31536000
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Content-Security-Policy: script-src 'report-sample' 'nonce-x2pRHk3uO85gZl3Bx0ujug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Cross-Origin-Opener-Policy: same-origin
    Server: ESF
    Content-Length: 0
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    c.pki.goog
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    172.217.16.227
  • flag-gb
    GET
    http://c.pki.goog/r/r1.crl
    Synaptics.exe
    Remote address:
    172.217.16.227:80
    Request
    GET /r/r1.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 854
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Fri, 24 Jan 2025 01:58:20 GMT
    Expires: Fri, 24 Jan 2025 02:48:20 GMT
    Cache-Control: public, max-age=3000
    Age: 2789
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-us
    DNS
    o.pki.goog
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    o.pki.goog
    IN A
    Response
    o.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    172.217.16.227
  • flag-gb
    GET
    http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDREXAZkIcRFgn9FoWvtnQ0
    Synaptics.exe
    Remote address:
    172.217.16.227:80
    Request
    GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDREXAZkIcRFgn9FoWvtnQ0 HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: o.pki.goog
    Response
    HTTP/1.1 200 OK
    Server: ocsp_responder
    Content-Length: 472
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    Date: Fri, 24 Jan 2025 02:15:57 GMT
    Cache-Control: public, max-age=14400
    Content-Type: application/ocsp-response
    Age: 1732
  • flag-gb
    GET
    http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCtrC6LRgin8QlSmIIYAEvj
    Synaptics.exe
    Remote address:
    172.217.16.227:80
    Request
    GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCtrC6LRgin8QlSmIIYAEvj HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: o.pki.goog
    Response
    HTTP/1.1 200 OK
    Server: ocsp_responder
    Content-Length: 472
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    Date: Fri, 24 Jan 2025 02:22:30 GMT
    Cache-Control: public, max-age=14400
    Content-Type: application/ocsp-response
    Age: 1340
  • flag-us
    DNS
    drive.usercontent.google.com
    Synaptics.exe
    Remote address:
    8.8.8.8:53
    Request
    drive.usercontent.google.com
    IN A
    Response
    drive.usercontent.google.com
    IN A
    216.58.204.65
  • flag-gb
    GET
    https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    216.58.204.65:443
    Request
    GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Cache-Control: no-cache
    Host: drive.usercontent.google.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 404 Not Found
    X-GUploader-UploadID: AFIdbgR6KR1KteQqxr0_QQi64lMlTDUHZnsfirmj8FsWNt7JjkKRfir2CdqT67DZnRis_AsMy05IZwo
    Content-Type: text/html; charset=utf-8
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Fri, 24 Jan 2025 02:44:50 GMT
    P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
    Content-Security-Policy: script-src 'report-sample' 'nonce-K9Ij6PzYe6xbEtfZL47WCA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Cross-Origin-Opener-Policy: same-origin
    Content-Length: 1652
    Server: UploadServer
    Set-Cookie: NID=520=CQk71hPshoK-_fRsPR2rupXwGSln5gFoIO3KnBt__X2dSiS8YvpfTqwmm6hqr3T6bk9VYsF6p-JBpTsXo6YM9oWwF_-H3LSwFTb6CKXKWj5QT92mjCQg5m-2l2sUJg575LbxQIu6OeP61WMFhJcusqnkRdAf6qKuXL6NCWCqk2fytqhYCllkzjx-; expires=Sat, 26-Jul-2025 02:44:50 GMT; path=/; domain=.google.com; HttpOnly
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Content-Security-Policy: sandbox allow-scripts
  • flag-gb
    GET
    https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    216.58.204.65:443
    Request
    GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Cache-Control: no-cache
    Host: drive.usercontent.google.com
    Connection: Keep-Alive
    Cookie: NID=520=CQk71hPshoK-_fRsPR2rupXwGSln5gFoIO3KnBt__X2dSiS8YvpfTqwmm6hqr3T6bk9VYsF6p-JBpTsXo6YM9oWwF_-H3LSwFTb6CKXKWj5QT92mjCQg5m-2l2sUJg575LbxQIu6OeP61WMFhJcusqnkRdAf6qKuXL6NCWCqk2fytqhYCllkzjx-
    Response
    HTTP/1.1 404 Not Found
    X-GUploader-UploadID: AFIdbgTG_FjQyMZ3x4HGM_fzexAdA0NUt3VQyBCi5FaQ-rEjsp-MRYMYxTyt4uA59DR2Skc8-5grTMw
    Content-Type: text/html; charset=utf-8
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Fri, 24 Jan 2025 02:44:50 GMT
    Content-Security-Policy: script-src 'report-sample' 'nonce-fBl9SRk9Bn6VdWdlqvRmaA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Cross-Origin-Opener-Policy: same-origin
    Content-Length: 1652
    Server: UploadServer
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Content-Security-Policy: sandbox allow-scripts
  • flag-gb
    GET
    https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    Synaptics.exe
    Remote address:
    216.58.204.65:443
    Request
    GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
    User-Agent: Synaptics.exe
    Cache-Control: no-cache
    Host: drive.usercontent.google.com
    Connection: Keep-Alive
    Cookie: NID=520=CQk71hPshoK-_fRsPR2rupXwGSln5gFoIO3KnBt__X2dSiS8YvpfTqwmm6hqr3T6bk9VYsF6p-JBpTsXo6YM9oWwF_-H3LSwFTb6CKXKWj5QT92mjCQg5m-2l2sUJg575LbxQIu6OeP61WMFhJcusqnkRdAf6qKuXL6NCWCqk2fytqhYCllkzjx-
    Response
    HTTP/1.1 404 Not Found
    X-GUploader-UploadID: AFIdbgSexz2B1tbw65zCB8r-suWuzzv9NKNIMkRXsL8R00JurtF2BLJX9M7YyHPayqyO-hK1
    Content-Type: text/html; charset=utf-8
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Fri, 24 Jan 2025 02:44:51 GMT
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Content-Security-Policy: script-src 'report-sample' 'nonce-Qxm_uVq02brV2wDBKo8ozQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Cross-Origin-Opener-Policy: same-origin
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
    Content-Length: 1652
    Server: UploadServer
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Content-Security-Policy: sandbox allow-scripts
  • flag-us
    DNS
    206.212.58.216.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.212.58.216.in-addr.arpa
    IN PTR
    Response
    206.212.58.216.in-addr.arpa
    IN PTR
    ams16s21-in-f2061e100net
    206.212.58.216.in-addr.arpa
    IN PTR
    lhr25s27-in-f14�J
    206.212.58.216.in-addr.arpa
    IN PTR
    ams16s21-in-f14�J
  • flag-us
    DNS
    227.16.217.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    227.16.217.172.in-addr.arpa
    IN PTR
    Response
    227.16.217.172.in-addr.arpa
    IN PTR
    lhr48s28-in-f31e100net
    227.16.217.172.in-addr.arpa
    IN PTR
    mad08s04-in-f3�H
  • flag-us
    DNS
    65.204.58.216.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    65.204.58.216.in-addr.arpa
    IN PTR
    Response
    65.204.58.216.in-addr.arpa
    IN PTR
    lhr25s13-in-f651e100net
    65.204.58.216.in-addr.arpa
    IN PTR
    lhr25s13-in-f1�H
    65.204.58.216.in-addr.arpa
    IN PTR
    lhr48s49-in-f1�H
  • 69.42.215.252:80
    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
    http
    Synaptics.exe
    660 B
     455 B
     11
    5

    HTTP Request

    GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    HTTP Response

    200
  • 216.58.212.206:443
    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    tls, http
    Synaptics.exe
    1.9kB
     11.3kB
     16
    14

    HTTP Request

    GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    303

    HTTP Request

    GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    303

    HTTP Request

    GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    303
  • 172.217.16.227:80
    http://c.pki.goog/r/r1.crl
    http
    Synaptics.exe
    303 B
     1.7kB
     4
    4

    HTTP Request

    GET http://c.pki.goog/r/r1.crl

    HTTP Response

    200
  • 172.217.16.227:80
    http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCtrC6LRgin8QlSmIIYAEvj
    http
    Synaptics.exe
    736 B
     1.6kB
     6
    4

    HTTP Request

    GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDREXAZkIcRFgn9FoWvtnQ0

    HTTP Response

    200

    HTTP Request

    GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCtrC6LRgin8QlSmIIYAEvj

    HTTP Response

    200
  • 216.58.204.65:443
    https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
    tls, http
    Synaptics.exe
    2.4kB
     14.7kB
     23
    21

    HTTP Request

    GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    404

    HTTP Request

    GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    404

    HTTP Request

    GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    HTTP Response

    404
  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    40.134.221.88.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    40.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    71.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    71.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    245.231.24.184.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    245.231.24.184.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    46.28.109.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    46.28.109.52.in-addr.arpa

  • 8.8.8.8:53
    xred.mooo.com
    dns
    Synaptics.exe
    59 B
     118 B
     1
    1

    DNS Request

    xred.mooo.com

  • 8.8.8.8:53
    freedns.afraid.org
    dns
    Synaptics.exe
    64 B
     80 B
     1
    1

    DNS Request

    freedns.afraid.org

    DNS Response

    69.42.215.252

  • 224.0.0.251:5353
    114 B
     2
  • 8.8.8.8:53
    252.215.42.69.in-addr.arpa
    dns
    144 B
     144 B
     2
    2

    DNS Request

    252.215.42.69.in-addr.arpa

    DNS Request

    252.215.42.69.in-addr.arpa

  • 8.8.8.8:53
    16.173.189.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    16.173.189.20.in-addr.arpa

  • 8.8.8.8:53
    244.160.67.23.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    244.160.67.23.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    docs.google.com
    dns
    Synaptics.exe
    61 B
     77 B
     1
    1

    DNS Request

    docs.google.com

    DNS Response

    216.58.212.206

  • 8.8.8.8:53
    c.pki.goog
    dns
    Synaptics.exe
    56 B
     107 B
     1
    1

    DNS Request

    c.pki.goog

    DNS Response

    172.217.16.227

  • 8.8.8.8:53
    o.pki.goog
    dns
    Synaptics.exe
    56 B
     107 B
     1
    1

    DNS Request

    o.pki.goog

    DNS Response

    172.217.16.227

  • 8.8.8.8:53
    drive.usercontent.google.com
    dns
    Synaptics.exe
    74 B
     90 B
     1
    1

    DNS Request

    drive.usercontent.google.com

    DNS Response

    216.58.204.65

  • 8.8.8.8:53
    206.212.58.216.in-addr.arpa
    dns
    73 B
     173 B
     1
    1

    DNS Request

    206.212.58.216.in-addr.arpa

  • 8.8.8.8:53
    227.16.217.172.in-addr.arpa
    dns
    73 B
     140 B
     1
    1

    DNS Request

    227.16.217.172.in-addr.arpa

  • 8.8.8.8:53
    65.204.58.216.in-addr.arpa
    dns
    72 B
     169 B
     1
    1

    DNS Request

    65.204.58.216.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe
    Filesize

    2.6MB

    MD5

    e050b1291c50f809e006b88704d7ed8c

    SHA1

    522e3d809aad8aece282dd7769f9df7608c4081a

    SHA256

    4bee0b05fcd9e9a15a04361b6f80bba1cd740c69f40f208ec0d4eba6e38acf23

    SHA512

    d3e6edfc917e325eaea94e8f884b417279d5b56ef77d8462a606a0d35a8cdc160c821f4b6cab0ae86655ccf822e1729e6ead562b03cbb8184330ba676d53f291

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\._cache_4bee0b05fcd9e9a15a04361b6f80bba1cd740c69f40f208ec0d4eba6e38acf23.exe
    Filesize

    1.9MB

    MD5

    33ae0c5d46d3955400bfc1ce57e929c7

    SHA1

    651740e8a6c9084a9d492d9e24bd8bb2e8b4068c

    SHA256

    1a4ea6b2bd297136cdab4b441c7466d79866c6bda0be46241461e012a16e607d

    SHA512

    36ba4736a63420271d28017343767ad2554f9bc2f269a66d0f8dec9ba49490ad2e026b85f75fef5ff310e5bea140306ad2ce805a23b7f51fb81321446dacf86e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\2C385E00
    Filesize

    23KB

    MD5

    80abb663945d6055deb8b1ab0ef0c232

    SHA1

    a93b884aac037a7f29168e1017d81b6aac27aaed

    SHA256

    316fd48ceb1b3d39662760dd29160ab859256c8dea9ede260b7a7629307ae423

    SHA512

    ee344fb8f28bf3f859cdadfae7651e6d201740e7f0964051d64acd6693162b05c62596f91e8142a11ed2e5ec811c289a1b736d14ba493966b773332c30de6259

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tDoGGTKE.xlsm
    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

    Download Submit

  • memory/736-144-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/736-143-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

    Filesize

    64KB

    Download

  • memory/736-145-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/736-139-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

    Filesize

    64KB

    Download

  • memory/736-141-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

    Filesize

    64KB

    Download

  • memory/736-140-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

    Filesize

    64KB

    Download

  • memory/736-142-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2080-0-0x0000000002440000-0x0000000002441000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2080-101-0x0000000000400000-0x00000000006A5000-memory.dmp

    Filesize

    2.6MB

    Download

  • memory/2188-136-0x0000000000400000-0x00000000006A5000-memory.dmp

    Filesize

    2.6MB

    Download

  • memory/2188-137-0x0000000000400000-0x00000000006A5000-memory.dmp

    Filesize

    2.6MB

    Download

  • memory/2188-104-0x0000000002300000-0x0000000002301000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2188-192-0x0000000000400000-0x00000000006A5000-memory.dmp

    Filesize

    2.6MB

    Download

  • memory/2188-223-0x0000000000400000-0x00000000006A5000-memory.dmp

    Filesize

    2.6MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.