Overview
overview
10Static
static
104b5d342b8c...86.exe
windows7-x64
94b5d342b8c...86.exe
windows10-2004-x64
94bb452a3de...a3.exe
windows7-x64
104bb452a3de...a3.exe
windows10-2004-x64
74bbf1f33d0...4d.exe
windows7-x64
84bbf1f33d0...4d.exe
windows10-2004-x64
84bc17871c1...64.exe
windows7-x64
104bc17871c1...64.exe
windows10-2004-x64
104be84836f6...c8.exe
windows7-x64
104be84836f6...c8.exe
windows10-2004-x64
104c2f38b994...d5.exe
windows7-x64
104c2f38b994...d5.exe
windows10-2004-x64
104c948e4226...26.exe
windows7-x64
104c948e4226...26.exe
windows10-2004-x64
104ca1d61a24...2e.exe
windows7-x64
104ca1d61a24...2e.exe
windows10-2004-x64
104cc3e6fe69...22.exe
windows7-x64
104cc3e6fe69...22.exe
windows10-2004-x64
104cf9706999...8e.exe
windows7-x64
104cf9706999...8e.exe
windows10-2004-x64
104d8cd82fa6...d5.exe
windows7-x64
104d8cd82fa6...d5.exe
windows10-2004-x64
104d947659fe...19.exe
windows7-x64
104d947659fe...19.exe
windows10-2004-x64
104dac62ad00...ec.exe
windows7-x64
104dac62ad00...ec.exe
windows10-2004-x64
104dde57eed0...7b.exe
windows7-x64
104dde57eed0...7b.exe
windows10-2004-x64
104e1fdde317...d3.exe
windows7-x64
104e1fdde317...d3.exe
windows10-2004-x64
104e248cce2f...a7.exe
windows7-x64
104e248cce2f...a7.exe
windows10-2004-x64
10Analysis
-
max time kernel
67s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:10
Behavioral task
behavioral1
Sample
4b5d342b8c5a5b19fac86b1315802786.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
4b5d342b8c5a5b19fac86b1315802786.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
4bb452a3de5825053bceee8fd5ee6db144ef8c4615a71a8408ee7de4df789fa3.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
4bb452a3de5825053bceee8fd5ee6db144ef8c4615a71a8408ee7de4df789fa3.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
4bbf1f33d0196e9a4ffae1877690bd000c7f728d546252ced45e60ecfe25e04d.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
4bbf1f33d0196e9a4ffae1877690bd000c7f728d546252ced45e60ecfe25e04d.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
4bc17871c10bb28c4e2b5e2f1d9e4664.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
4bc17871c10bb28c4e2b5e2f1d9e4664.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral9
Sample
4be84836f68985fd15cbf992a7b0e782d1bab4439960e27c6e252e76a89ce2c8.exe
Resource
win7-20250207-en
Behavioral task
behavioral10
Sample
4be84836f68985fd15cbf992a7b0e782d1bab4439960e27c6e252e76a89ce2c8.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
4c2f38b99403c4aaca4e0a524b094c17b8d7b462af1041dee9e7562c512af4d5.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
4c2f38b99403c4aaca4e0a524b094c17b8d7b462af1041dee9e7562c512af4d5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
4c948e42267877c379b01be5faa66926.exe
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
4c948e42267877c379b01be5faa66926.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
4ca1d61a2465b19118d75478ec45e38cf03e101fd7422cfb04e4a526251ac92e.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
4ca1d61a2465b19118d75478ec45e38cf03e101fd7422cfb04e4a526251ac92e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
4cc3e6fe699a661d5a6ea786a93cfacd887570860b351476e5f5a1d3616bf922.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
4cc3e6fe699a661d5a6ea786a93cfacd887570860b351476e5f5a1d3616bf922.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
4cf97069999c57b9ff02fc34f4efbe8e.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
4cf97069999c57b9ff02fc34f4efbe8e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
4d8cd82fa6662df02eb5af2abbf815d5.exe
Resource
win7-20241023-en
Behavioral task
behavioral22
Sample
4d8cd82fa6662df02eb5af2abbf815d5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
4d947659fef83a302fd6b7451b980b19.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
4d947659fef83a302fd6b7451b980b19.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
4dac62ad007ffed0e0d4b738af6da8ec.exe
Resource
win7-20250207-en
Behavioral task
behavioral26
Sample
4dac62ad007ffed0e0d4b738af6da8ec.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
4dde57eed00149aa841c1408694ff4614ca0f5c17c6b4ef8040bef7639be857b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
4dde57eed00149aa841c1408694ff4614ca0f5c17c6b4ef8040bef7639be857b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
4e1fdde317913d69f35aa03397b5ded3.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
4e1fdde317913d69f35aa03397b5ded3.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
4e248cce2fb9b5f155ca62d21c6e9da7.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
4e248cce2fb9b5f155ca62d21c6e9da7.exe
Resource
win10v2004-20250314-en
General
-
Target
4d8cd82fa6662df02eb5af2abbf815d5.exe
-
Size
14.3MB
-
MD5
4d8cd82fa6662df02eb5af2abbf815d5
-
SHA1
9a204dbafb47d5b1e40908011bac6201c4699abc
-
SHA256
1c96153b02b612f06efaea43f046bc0e3e8d9f2248faf8e4d19026d87a0ce8ba
-
SHA512
dbd290b3e39f1ab3f8d99241e4d0cdb9645762ca7ca6436f5fc2ebea6db9caff1de5a6788ec0f83ad75e2b4d9af25f72048550b2e1da9b24ea21c7c90aa19fb5
-
SSDEEP
393216:SGg4a7Gg4anGg4aDGg4aDGg4anGg4aOGg4aS:AbXzzXMS
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3440 powershell.exe 5100 powershell.exe 2848 powershell.exe 1916 powershell.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation 4d8cd82fa6662df02eb5af2abbf815d5.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation 4d8cd82fa6662df02eb5af2abbf815d5.exe -
Executes dropped EXE 3 IoCs
pid Process 2684 ._cache_4d8cd82fa6662df02eb5af2abbf815d5.exe 2112 Synaptics.exe 3024 Synaptics.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_4d8cd82fa6662df02eb5af2abbf815d5.exe Key opened \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_4d8cd82fa6662df02eb5af2abbf815d5.exe Key opened \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_4d8cd82fa6662df02eb5af2abbf815d5.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 4d8cd82fa6662df02eb5af2abbf815d5.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 36 checkip.dyndns.org 40 reallyfreegeoip.org 42 reallyfreegeoip.org 72 reallyfreegeoip.org -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4576 set thread context of 4332 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 103 PID 2112 set thread context of 3024 2112 Synaptics.exe 118 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4d8cd82fa6662df02eb5af2abbf815d5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4d8cd82fa6662df02eb5af2abbf815d5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_4d8cd82fa6662df02eb5af2abbf815d5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 4d8cd82fa6662df02eb5af2abbf815d5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3508 schtasks.exe 3576 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 3440 powershell.exe 5100 powershell.exe 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 3440 powershell.exe 5100 powershell.exe 5100 powershell.exe 2684 ._cache_4d8cd82fa6662df02eb5af2abbf815d5.exe 2112 Synaptics.exe 2112 Synaptics.exe 2112 Synaptics.exe 2112 Synaptics.exe 2112 Synaptics.exe 2112 Synaptics.exe 2112 Synaptics.exe 2112 Synaptics.exe 1916 powershell.exe 1916 powershell.exe 2112 Synaptics.exe 2112 Synaptics.exe 2848 powershell.exe 2848 powershell.exe 1916 powershell.exe 2848 powershell.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe Token: SeDebugPrivilege 3440 powershell.exe Token: SeDebugPrivilege 5100 powershell.exe Token: SeDebugPrivilege 2684 ._cache_4d8cd82fa6662df02eb5af2abbf815d5.exe Token: SeDebugPrivilege 2112 Synaptics.exe Token: SeDebugPrivilege 1916 powershell.exe Token: SeDebugPrivilege 2848 powershell.exe Token: SeDebugPrivilege 4192 ._cache_Synaptics.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 4576 wrote to memory of 3440 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 95 PID 4576 wrote to memory of 3440 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 95 PID 4576 wrote to memory of 3440 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 95 PID 4576 wrote to memory of 5100 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 97 PID 4576 wrote to memory of 5100 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 97 PID 4576 wrote to memory of 5100 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 97 PID 4576 wrote to memory of 3508 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 99 PID 4576 wrote to memory of 3508 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 99 PID 4576 wrote to memory of 3508 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 99 PID 4576 wrote to memory of 4512 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 101 PID 4576 wrote to memory of 4512 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 101 PID 4576 wrote to memory of 4512 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 101 PID 4576 wrote to memory of 1216 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 102 PID 4576 wrote to memory of 1216 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 102 PID 4576 wrote to memory of 1216 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 102 PID 4576 wrote to memory of 4332 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 103 PID 4576 wrote to memory of 4332 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 103 PID 4576 wrote to memory of 4332 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 103 PID 4576 wrote to memory of 4332 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 103 PID 4576 wrote to memory of 4332 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 103 PID 4576 wrote to memory of 4332 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 103 PID 4576 wrote to memory of 4332 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 103 PID 4576 wrote to memory of 4332 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 103 PID 4576 wrote to memory of 4332 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 103 PID 4576 wrote to memory of 4332 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 103 PID 4576 wrote to memory of 4332 4576 4d8cd82fa6662df02eb5af2abbf815d5.exe 103 PID 4332 wrote to memory of 2684 4332 4d8cd82fa6662df02eb5af2abbf815d5.exe 104 PID 4332 wrote to memory of 2684 4332 4d8cd82fa6662df02eb5af2abbf815d5.exe 104 PID 4332 wrote to memory of 2684 4332 4d8cd82fa6662df02eb5af2abbf815d5.exe 104 PID 4332 wrote to memory of 2112 4332 4d8cd82fa6662df02eb5af2abbf815d5.exe 105 PID 4332 wrote to memory of 2112 4332 4d8cd82fa6662df02eb5af2abbf815d5.exe 105 PID 4332 wrote to memory of 2112 4332 4d8cd82fa6662df02eb5af2abbf815d5.exe 105 PID 2112 wrote to memory of 1916 2112 Synaptics.exe 112 PID 2112 wrote to memory of 1916 2112 Synaptics.exe 112 PID 2112 wrote to memory of 1916 2112 Synaptics.exe 112 PID 2112 wrote to memory of 2848 2112 Synaptics.exe 114 PID 2112 wrote to memory of 2848 2112 Synaptics.exe 114 PID 2112 wrote to memory of 2848 2112 Synaptics.exe 114 PID 2112 wrote to memory of 3576 2112 Synaptics.exe 116 PID 2112 wrote to memory of 3576 2112 Synaptics.exe 116 PID 2112 wrote to memory of 3576 2112 Synaptics.exe 116 PID 2112 wrote to memory of 3024 2112 Synaptics.exe 118 PID 2112 wrote to memory of 3024 2112 Synaptics.exe 118 PID 2112 wrote to memory of 3024 2112 Synaptics.exe 118 PID 2112 wrote to memory of 3024 2112 Synaptics.exe 118 PID 2112 wrote to memory of 3024 2112 Synaptics.exe 118 PID 2112 wrote to memory of 3024 2112 Synaptics.exe 118 PID 2112 wrote to memory of 3024 2112 Synaptics.exe 118 PID 2112 wrote to memory of 3024 2112 Synaptics.exe 118 PID 2112 wrote to memory of 3024 2112 Synaptics.exe 118 PID 2112 wrote to memory of 3024 2112 Synaptics.exe 118 PID 2112 wrote to memory of 3024 2112 Synaptics.exe 118 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_4d8cd82fa6662df02eb5af2abbf815d5.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_4d8cd82fa6662df02eb5af2abbf815d5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d8cd82fa6662df02eb5af2abbf815d5.exe"C:\Users\Admin\AppData\Local\Temp\4d8cd82fa6662df02eb5af2abbf815d5.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4d8cd82fa6662df02eb5af2abbf815d5.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3440
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sXLAWJKdeDZVj.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sXLAWJKdeDZVj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2304.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3508
-
-
C:\Users\Admin\AppData\Local\Temp\4d8cd82fa6662df02eb5af2abbf815d5.exe"C:\Users\Admin\AppData\Local\Temp\4d8cd82fa6662df02eb5af2abbf815d5.exe"2⤵PID:4512
-
-
C:\Users\Admin\AppData\Local\Temp\4d8cd82fa6662df02eb5af2abbf815d5.exe"C:\Users\Admin\AppData\Local\Temp\4d8cd82fa6662df02eb5af2abbf815d5.exe"2⤵PID:1216
-
-
C:\Users\Admin\AppData\Local\Temp\4d8cd82fa6662df02eb5af2abbf815d5.exe"C:\Users\Admin\AppData\Local\Temp\4d8cd82fa6662df02eb5af2abbf815d5.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\._cache_4d8cd82fa6662df02eb5af2abbf815d5.exe"C:\Users\Admin\AppData\Local\Temp\._cache_4d8cd82fa6662df02eb5af2abbf815d5.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2684
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sXLAWJKdeDZVj.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sXLAWJKdeDZVj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA544.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3576
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4192
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵PID:1276
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.3MB
MD54d8cd82fa6662df02eb5af2abbf815d5
SHA19a204dbafb47d5b1e40908011bac6201c4699abc
SHA2561c96153b02b612f06efaea43f046bc0e3e8d9f2248faf8e4d19026d87a0ce8ba
SHA512dbd290b3e39f1ab3f8d99241e4d0cdb9645762ca7ca6436f5fc2ebea6db9caff1de5a6788ec0f83ad75e2b4d9af25f72048550b2e1da9b24ea21c7c90aa19fb5
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5a75ad4aebd987125ed279f135c45e803
SHA1baee03534e97f56dddbb8db567c789f88934d521
SHA256b746e5f120da395a019258cc00094a40626a636bfca2fdc7b722e1946c882cb4
SHA5123642da05c7b096bff0edbe9a0ae6a2d5349c6937a5e6c1576c5e86896f1eadb5c4c62ee577090e2de585dd144efcdc7fcef2ec38f522c03c942dccbd423b149a
-
Filesize
18KB
MD5acc09b1c49cf4d7547715b2ce7c0b6d4
SHA1f50d3298225e6c43b5381cefb9ed14c87fa0545b
SHA25645755b33bb10f5271b4e68efe34071c5c498a4eeef16ad2a6f39438fafe6371a
SHA5124518bce75e62d3a06a61429b7af88513cdbf3337c813ec90e3ad39c746c64cc75850c19c8792f0e64e42d32cca914c63ec072323d9fec866162b175c40834fde
-
Filesize
91KB
MD5b45e3c4c10da3da0c69e2f90dc3dfb10
SHA161a36473ced38978793a9af1aea1fc528eebe457
SHA256b6fe518ed8ca7ee32f79bb5dd52ab8250cc595d1aa8daec123cef383c6b0bdb6
SHA51244d0c2e0904702dd22c92004415ef3c821bf63de0fb0cc6d7cca41eab36f32531530dd5fdb48017fc5405c7554ae6387514ef3f4e74eea4b36a14d587742e15b
-
Filesize
22KB
MD5ac16d8214b891712efbe4270dc0f7356
SHA1c2ee64e25598083aa975161dfacdafb8cb31ec77
SHA256815b68dd038bdfb3f54f0b8286558abc7b6fe8a670876c63b28d0045e00f545b
SHA512855bd7bb0a3799801c99bbc8c474ae03c715fd7a1d6865007e40b40cac9ce9414e7519b7549abf7d2cb3325fa62df3c7d2aa55b002bc1b4304a54ae16a2a7f3a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5b8d0c9983df15bb6461ab648d8a3941e
SHA1497df7a240408c9fb891f69ddb54b924632357ee
SHA25631d53aa920c37251d34f6b5173f53f0d6beda6e5515f9cd1050a4517f539b1cb
SHA51238228490f35efb2c3b839109c9c5d274516b507ba7e074626a809bb1faa395c4b4ef527481cf49483e20086a4a1b78f4761dde235d1fcbfc4cc6da09f1b40b82