Analysis
- max time kernel
37s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/08/2026, 22:30
General
- Target 95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe
- Size 9.4MB
- Sample260830-2e4s8s1erg
- SHA256 95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
sality
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
- Family: Sality
Sality is backdoor written in C++, first discovered in 2003.
- Family: Xred
Xred is backdoor written in Delphi.
- Detect PurpleFox Rootkit 10 IoCs
Detect PurpleFox Rootkit.
- Gh0st RAT payload 11 IoCs
- Modifies firewall policy service 3 TTPs 6 IoCs
- UAC bypass 3 TTPs 2 IoCs
- Windows security bypass 2 TTPs 12 IoCs
- Drops file in Drivers directory 1 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 3 IoCs
- Windows security modification 2 TTPs 14 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 6 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- UPX packed file 44 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 5 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies registry class 2 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe"C:\Users\Admin\AppData\Local\Temp\95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe3⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\HD_95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exeC:\Users\Admin\AppData\Local\Temp\HD_95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\._cache_HD_95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe"C:\Users\Admin\AppData\Local\Temp\._cache_HD_95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe"4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 18445⤵
- Program crash
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240660921.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "╓≈╢»╖└╙∙╖■╬±─ú┐Θ"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 4322⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4864 -ip 48641⤵
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4272 -ip 42721⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Pre-OS Boot
1Bootkit
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
msedge.exe
OfficeClickToRun.exe
._cache_HD_95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe
HD_95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe
HD_X.dat
svchos.exe
svchost.exe
SYSTEM.INI
240660921.txt
Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
rwiial.exe
memory/540-117-0x0000000001260000-0x0000000001261000-memory.dmp
memory/540-171-0x0000000001140000-0x0000000001142000-memory.dmp
memory/540-173-0x0000000001140000-0x0000000001142000-memory.dmp
memory/1612-30-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1612-13-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1612-16-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1612-19-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1612-15-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/2052-58-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-245-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-57-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-53-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-64-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-56-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-65-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-84-0x00000000067B0000-0x00000000067B2000-memory.dmp
memory/2052-66-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-236-0x00000000067B0000-0x00000000067B2000-memory.dmp
memory/2052-51-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-77-0x0000000006900000-0x0000000006901000-memory.dmp
memory/2052-52-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-250-0x0000000000400000-0x0000000000C34000-memory.dmp
memory/2052-228-0x0000000000400000-0x0000000000C34000-memory.dmp
memory/2052-188-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-118-0x0000000000400000-0x0000000000C34000-memory.dmp
memory/2052-114-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-49-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-115-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-48-0x0000000000400000-0x0000000000C34000-memory.dmp
memory/2052-186-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/2052-175-0x00000000029E0000-0x0000000003A9A000-memory.dmp
memory/3212-355-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-335-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-327-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-328-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-329-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-331-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-333-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-351-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-337-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-339-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-315-0x0000000001740000-0x0000000001741000-memory.dmp
memory/3212-341-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-314-0x0000000001730000-0x0000000001731000-memory.dmp
memory/3212-313-0x0000000001720000-0x0000000001721000-memory.dmp
memory/3212-312-0x0000000001710000-0x0000000001711000-memory.dmp
memory/3212-311-0x0000000001470000-0x0000000001471000-memory.dmp
memory/3212-310-0x0000000001440000-0x0000000001441000-memory.dmp
memory/3212-309-0x0000000001320000-0x0000000001321000-memory.dmp
memory/3212-308-0x00000000012C0000-0x00000000012C1000-memory.dmp
memory/3212-318-0x0000000000400000-0x000000000119C000-memory.dmp
memory/3212-343-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-353-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-345-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-349-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3212-347-0x0000000010000000-0x000000001003E000-memory.dmp
memory/3428-6-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3428-5-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3428-10-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3428-7-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3496-37-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3496-36-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3496-32-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/4212-83-0x00000000025F0000-0x00000000025F2000-memory.dmp
memory/4212-73-0x0000000003080000-0x0000000003081000-memory.dmp
memory/4212-72-0x00000000025F0000-0x00000000025F2000-memory.dmp
memory/4216-113-0x0000000000F30000-0x0000000000F32000-memory.dmp
memory/4216-176-0x0000000000F30000-0x0000000000F32000-memory.dmp
memory/4216-75-0x0000000000F40000-0x0000000000F41000-memory.dmp
memory/4272-483-0x0000000000400000-0x0000000000C34000-memory.dmp
memory/4272-249-0x0000000000400000-0x0000000000C34000-memory.dmp
memory/4864-317-0x0000000000400000-0x0000000000C34000-memory.dmp