Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
- submitted
13/10/2025, 04:29
General
- Target IndentNo0400372.exe
- Size 1.4MB
- Sample251013-e4nf8avlv7
- SHA256 21cc7ac1ac49cdf7fad0c815c52f12809950fcf738af80c2902a19c4c636cacf
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
redline
-
cheat
-
109.248.151.156:51098
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 7 IoCs
- Redline family
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 7 IoCs
- Sectoprat family
- Xred
Xred is backdoor written in Delphi.
- Xred family
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IndentNo0400372.exe"C:\Users\Admin\AppData\Local\Temp\IndentNo0400372.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\._cache_MSBuild.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
Synaptics.exe
Synaptics.exe.log
._cache_MSBuild.exe
tmp147E.tmp
tmp14A3.tmp
tmp14CE.tmp
tmp14F4.tmp
tmp150F.tmp
memory/1580-10-0x0000000000400000-0x00000000004DA000-memory.dmp
memory/1580-9-0x0000000000400000-0x00000000004DA000-memory.dmp
memory/1580-138-0x0000000000400000-0x00000000004DA000-memory.dmp
memory/1580-12-0x0000000000400000-0x00000000004DA000-memory.dmp
memory/1580-13-0x0000000000400000-0x00000000004DA000-memory.dmp
memory/1580-14-0x0000000002D90000-0x0000000002D91000-memory.dmp
memory/4820-6-0x00000000063A0000-0x00000000063B4000-memory.dmp
memory/4820-7-0x0000000004AB0000-0x0000000004AC0000-memory.dmp
memory/4820-5-0x0000000004F10000-0x0000000004FAC000-memory.dmp
memory/4820-8-0x0000000006410000-0x000000000652E000-memory.dmp
memory/4820-0-0x0000000000130000-0x00000000002A6000-memory.dmp
memory/4820-4-0x0000000004E20000-0x0000000004E2A000-memory.dmp
memory/4820-3-0x0000000004AB0000-0x0000000004AC0000-memory.dmp
memory/4820-2-0x0000000004B20000-0x0000000004BB2000-memory.dmp
memory/4820-1-0x00000000051C0000-0x0000000005764000-memory.dmp
memory/5168-139-0x0000000005D00000-0x0000000006318000-memory.dmp
memory/5168-144-0x00000000057E0000-0x000000000582C000-memory.dmp
memory/5168-148-0x0000000005A40000-0x0000000005B4A000-memory.dmp
memory/5168-262-0x0000000007350000-0x000000000736E000-memory.dmp
memory/5168-151-0x0000000006D20000-0x0000000006EE2000-memory.dmp
memory/5168-152-0x0000000007420000-0x000000000794C000-memory.dmp
memory/5168-153-0x0000000006CB0000-0x0000000006D16000-memory.dmp
memory/5168-261-0x0000000007250000-0x00000000072C6000-memory.dmp
memory/5168-135-0x0000000000EC0000-0x0000000000EDE000-memory.dmp
memory/5168-142-0x00000000057A0000-0x00000000057DC000-memory.dmp
memory/5168-140-0x0000000005740000-0x0000000005752000-memory.dmp
memory/5848-145-0x0000000001570000-0x000000000158A000-memory.dmp
memory/5848-146-0x0000000005780000-0x00000000058DA000-memory.dmp
memory/5848-143-0x0000000000C60000-0x0000000000CA0000-memory.dmp