Analysis
- max time kernel
149s - max time network
106s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
13/10/2025, 04:29
General
- Target IndentNo0400372.exe
- Size 1.4MB
- Sample251013-e4nf8avlv7
- SHA256 21cc7ac1ac49cdf7fad0c815c52f12809950fcf738af80c2902a19c4c636cacf
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
redline
-
cheat
-
109.248.151.156:51098
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 7 IoCs
- Redline family
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 7 IoCs
- Sectoprat family
- Xred
Xred is backdoor written in Delphi.
- Xred family
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IndentNo0400372.exe"C:\Users\Admin\AppData\Local\Temp\IndentNo0400372.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\._cache_MSBuild.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
Synaptics.exe
Synaptics.exe.log
._cache_MSBuild.exe
tmpE010.tmp
tmpE026.tmp
tmpE061.tmp
tmpE067.tmp
tmpE092.tmp
memory/228-4-0x0000000004F30000-0x0000000004F3A000-memory.dmp
memory/228-8-0x00000000066E0000-0x00000000067FE000-memory.dmp
memory/228-7-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/228-6-0x0000000006670000-0x0000000006684000-memory.dmp
memory/228-5-0x0000000005220000-0x00000000052BC000-memory.dmp
memory/228-3-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/228-2-0x0000000004F60000-0x0000000004FF2000-memory.dmp
memory/228-1-0x00000000055E0000-0x0000000005B86000-memory.dmp
memory/228-0-0x0000000000330000-0x00000000004A6000-memory.dmp
memory/3460-151-0x00000000068D0000-0x0000000006A92000-memory.dmp
memory/3460-150-0x00000000054D0000-0x00000000055DA000-memory.dmp
memory/3460-140-0x00000000051D0000-0x00000000051E2000-memory.dmp
memory/3460-250-0x0000000007570000-0x00000000075D6000-memory.dmp
memory/3460-154-0x0000000006E90000-0x0000000006EAE000-memory.dmp
memory/3460-144-0x0000000005230000-0x000000000526C000-memory.dmp
memory/3460-153-0x0000000006B40000-0x0000000006BB6000-memory.dmp
memory/3460-147-0x0000000005270000-0x00000000052BC000-memory.dmp
memory/3460-152-0x0000000006FD0000-0x00000000074FC000-memory.dmp
memory/3460-139-0x0000000005790000-0x0000000005DA8000-memory.dmp
memory/3460-137-0x0000000000880000-0x000000000089E000-memory.dmp
memory/4860-138-0x0000000000400000-0x00000000004DA000-memory.dmp
memory/4860-14-0x0000000002FD0000-0x0000000002FD1000-memory.dmp
memory/4860-13-0x0000000000400000-0x00000000004DA000-memory.dmp
memory/4860-12-0x0000000000400000-0x00000000004DA000-memory.dmp
memory/4860-10-0x0000000000400000-0x00000000004DA000-memory.dmp
memory/4860-9-0x0000000000400000-0x00000000004DA000-memory.dmp
memory/5028-145-0x0000000005090000-0x00000000051EA000-memory.dmp
memory/5028-143-0x0000000002910000-0x000000000292A000-memory.dmp
memory/5028-142-0x00000000005A0000-0x00000000005E0000-memory.dmp