Analysis
- max time kernel
31s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
30/08/2026, 22:30
General
- Target 95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe
- Size 9.4MB
- Sample260830-2e4s8s1erg
- SHA256 95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
sality
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
- Family: Sality
Sality is backdoor written in C++, first discovered in 2003.
- Family: Xred
Xred is backdoor written in Delphi.
- Detect PurpleFox Rootkit 11 IoCs
Detect PurpleFox Rootkit.
- Gh0st RAT payload 12 IoCs
- Modifies firewall policy service 3 TTPs 9 IoCs
- UAC bypass 3 TTPs 3 IoCs
- Windows security bypass 2 TTPs 18 IoCs
- Drops file in Drivers directory 1 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 3 IoCs
- Windows security modification 2 TTPs 21 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 5 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- UPX packed file 48 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 4 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
C:\Users\Admin\AppData\Local\Temp\95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe"C:\Users\Admin\AppData\Local\Temp\95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe"3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul5⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.16⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe4⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\HD_95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exeC:\Users\Admin\AppData\Local\Temp\HD_95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\._cache_HD_95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe"C:\Users\Admin\AppData\Local\Temp\._cache_HD_95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe"5⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 5206⤵
- Program crash
-
-
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240739031.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "╓≈╢»╖└╙∙╖■╬±─ú┐Θ"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2964 -ip 29641⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 4882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2820 -ip 28201⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Pre-OS Boot
1Bootkit
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
Synaptics.exe
._cache_HD_95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe
HD_95e74616c598496ac15227b4acb36264f2f3d9958ed19e239d4c6d6372a7e294.exe
HD_X.dat
svchos.exe
svchost.exe
SYSTEM.INI
240739031.txt
Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
ycfj.pif
memory/300-160-0x0000000001130000-0x0000000001132000-memory.dmp
memory/300-72-0x00000000014D0000-0x00000000014D1000-memory.dmp
memory/300-162-0x0000000001130000-0x0000000001132000-memory.dmp
memory/1212-67-0x0000000002430000-0x0000000002432000-memory.dmp
memory/1212-68-0x0000000002500000-0x0000000002501000-memory.dmp
memory/1212-75-0x0000000002430000-0x0000000002432000-memory.dmp
memory/2544-36-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/2544-41-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/2544-39-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/2544-28-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/2768-204-0x0000000007AC0000-0x0000000007AC2000-memory.dmp
memory/2768-49-0x0000000002B90000-0x0000000003C4A000-memory.dmp
memory/2768-52-0x0000000002B90000-0x0000000003C4A000-memory.dmp
memory/2768-57-0x0000000002B90000-0x0000000003C4A000-memory.dmp
memory/2768-62-0x0000000002B90000-0x0000000003C4A000-memory.dmp
memory/2768-66-0x0000000002B90000-0x0000000003C4A000-memory.dmp
memory/2768-65-0x0000000002B90000-0x0000000003C4A000-memory.dmp
memory/2768-76-0x0000000007AC0000-0x0000000007AC2000-memory.dmp
memory/2768-54-0x0000000002B90000-0x0000000003C4A000-memory.dmp
memory/2768-74-0x0000000007C10000-0x0000000007C11000-memory.dmp
memory/2768-51-0x0000000002B90000-0x0000000003C4A000-memory.dmp
memory/2768-202-0x0000000002B90000-0x0000000003C4A000-memory.dmp
memory/2768-48-0x0000000000400000-0x0000000000C34000-memory.dmp
memory/2768-64-0x0000000002B90000-0x0000000003C4A000-memory.dmp
memory/2768-158-0x0000000002B90000-0x0000000003C4A000-memory.dmp
memory/2768-53-0x0000000002B90000-0x0000000003C4A000-memory.dmp
memory/2768-153-0x0000000002B90000-0x0000000003C4A000-memory.dmp
memory/2768-219-0x0000000000400000-0x0000000000C34000-memory.dmp
memory/2820-281-0x0000000000400000-0x00000000004C0000-memory.dmp
memory/2964-217-0x0000000000400000-0x00000000004C0000-memory.dmp
memory/2964-283-0x0000000000400000-0x00000000004C0000-memory.dmp
memory/2988-233-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-241-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-263-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-220-0x0000000001300000-0x0000000001301000-memory.dmp
memory/2988-221-0x00000000013B0000-0x00000000013B1000-memory.dmp
memory/2988-222-0x0000000002E50000-0x0000000002E51000-memory.dmp
memory/2988-223-0x0000000002E80000-0x0000000002E81000-memory.dmp
memory/2988-271-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-269-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-267-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-265-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-261-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-259-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-257-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-255-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-253-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-251-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-249-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-247-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-245-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-243-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-224-0x0000000002E90000-0x0000000002E91000-memory.dmp
memory/2988-239-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-237-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-235-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-225-0x0000000002EA0000-0x0000000002EA1000-memory.dmp
memory/2988-232-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-231-0x0000000010000000-0x000000001003E000-memory.dmp
memory/2988-228-0x0000000000400000-0x000000000119C000-memory.dmp
memory/2988-227-0x0000000002EC0000-0x0000000002EC1000-memory.dmp
memory/2988-226-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
memory/4428-159-0x0000000000F00000-0x0000000000F02000-memory.dmp
memory/4428-70-0x0000000000F10000-0x0000000000F11000-memory.dmp
memory/4436-14-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/4436-11-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/4436-13-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/4436-23-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/4436-15-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/5868-8-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/5868-7-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/5868-9-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/5868-6-0x0000000010000000-0x00000000101B6000-memory.dmp