Analysis
-
max time kernel
114s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2025 00:08
Behavioral task
behavioral1
Sample
ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe
Resource
win10v2004-20250207-en
General
-
Target
ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe
-
Size
764KB
-
MD5
571d08ccfddffcec2843c61101b91ce0
-
SHA1
bab4c2187e02aae0e5471c320c1c7ba437b0677a
-
SHA256
ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189
-
SHA512
e5cdcde4775fd7dfc9203964ac7661c03d4e3c5f8f9dabecf342a846d86fad4d4e3ba7b762cb60dc9ff784b4656634028b5c520b22928a1ee6c572d0f7b4ff8c
-
SSDEEP
12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9U8uj:6nsJ39LyjbJkQFMhmC+6GD9c
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Downloads MZ/PE file 1 IoCs
flow pid Process 69 2556 Process not Found -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000\Control Panel\International\Geo\Nation ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe Key value queried \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 4104 ._cache_ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe 5028 Synaptics.exe 2272 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4552 4104 WerFault.exe 87 2420 2272 WerFault.exe 94 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1600 MicrosoftEdgeUpdate.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4756 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3084 wrote to memory of 4104 3084 ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe 87 PID 3084 wrote to memory of 4104 3084 ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe 87 PID 3084 wrote to memory of 4104 3084 ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe 87 PID 3084 wrote to memory of 5028 3084 ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe 89 PID 3084 wrote to memory of 5028 3084 ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe 89 PID 3084 wrote to memory of 5028 3084 ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe 89 PID 5028 wrote to memory of 2272 5028 Synaptics.exe 94 PID 5028 wrote to memory of 2272 5028 Synaptics.exe 94 PID 5028 wrote to memory of 2272 5028 Synaptics.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe"C:\Users\Admin\AppData\Local\Temp\ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\._cache_ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 8483⤵
- Program crash
PID:4552
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 8484⤵
- Program crash
PID:2420
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4104 -ip 41041⤵PID:3520
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2272 -ip 22721⤵PID:3984
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjUwNTAzRDktNTRFQy00N0E1LTkwQzctQUY5QkU2NjE4REJDfSIgdXNlcmlkPSJ7RENBM0I1MDQtQTRGNC00QTdCLThDNDEtNzZBQUM2MkU5N0EyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RUU3QUIxQzMtMzJFNC00OENBLUE5NTYtMzc2NEQzRjNDMjZDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI5IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5ODUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODQ0NDQzNjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDc2MjY4OTY0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1600
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
764KB
MD5571d08ccfddffcec2843c61101b91ce0
SHA1bab4c2187e02aae0e5471c320c1c7ba437b0677a
SHA256ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189
SHA512e5cdcde4775fd7dfc9203964ac7661c03d4e3c5f8f9dabecf342a846d86fad4d4e3ba7b762cb60dc9ff784b4656634028b5c520b22928a1ee6c572d0f7b4ff8c
-
C:\Users\Admin\AppData\Local\Temp\._cache_ee471566f4eedc108b201198cb8d0da4ada5b6c4e039ff591c3ca0adb9f63189N.exe
Filesize10KB
MD5d6cc515af460a8eaaa15716772301659
SHA16168861e0633298e0be0d2fce572fdf1e244db69
SHA256e71de20f637366d37723164a62bbfeafcfb08e0411b3f78ebcf13c8e8aae0e5c
SHA512fbf2cea4716ef56c38ea31353b84b785b757942cc14a9c1bb3b1d83556b4e28c1f647cdd97d0db09d3c5e2d90c722b6f2c094e4e2070605f2f93dedb0a912943
-
Filesize
26KB
MD5a849188bbdc7a2aa7a4a3b1a51cea28a
SHA12e1ab1561eeb7ef3f5b5a6c3fa40ce395104c86a
SHA2568b4c3fbbde94e5e49cce57b1de224cb104ed7c01e95889effbd677f2637488ae
SHA512dd4056cffd97ac20af0608d9c82d1b11f8dd37ce8e1e120ed2796c7a092017d45e5c2cda7b6becbd36a4005cab1fed97aded4fff89cf53c8d5b062c7fa1a8040
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04