xred | de428d7f626437a5251cd34820ccb446d122ccf6bf2cb9f5c4c941de46c559b7

General

Target

dm.exe
Size

1.7MB
MD5

4732b427adf5a2856c1b35b528393f9c
SHA1

784fa6ee208239cf4a49b13adf0e906f292017d7
SHA256

de428d7f626437a5251cd34820ccb446d122ccf6bf2cb9f5c4c941de46c559b7
SHA512

b46d20a0219351f0fede70cb7e927da1af1f369089c4a2c00299962fd0368b7383373b10cc84f7fe7fcd24aa3a88c56c2ce7f4e23421783bbf02bfa6d3287e22
SSDEEP

49152:mnsHyjtk2MYC5GDAl26YMSCa0FgiLn1nd2:mnsmtk2a9JrSCa0F/n1nQ

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
2360	._cache_dm.exe
2960	Synaptics.exe
2828	._cache_Synaptics.exe

Loads dropped DLL 7 IoCs

pid	Process
3048	dm.exe
3048	dm.exe
3048	dm.exe
3048	dm.exe
2960	Synaptics.exe
2960	Synaptics.exe
2960	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	dm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_dm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dm.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2360	._cache_dm.exe
2360	._cache_dm.exe
2828	._cache_Synaptics.exe
2828	._cache_Synaptics.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2360	3048	dm.exe	28
PID 3048 wrote to memory of 2360	3048	dm.exe	28
PID 3048 wrote to memory of 2360	3048	dm.exe	28
PID 3048 wrote to memory of 2360	3048	dm.exe	28
PID 3048 wrote to memory of 2960	3048	dm.exe	29
PID 3048 wrote to memory of 2960	3048	dm.exe	29
PID 3048 wrote to memory of 2960	3048	dm.exe	29
PID 3048 wrote to memory of 2960	3048	dm.exe	29
PID 2960 wrote to memory of 2828	2960	Synaptics.exe	30
PID 2960 wrote to memory of 2828	2960	Synaptics.exe	30
PID 2960 wrote to memory of 2828	2960	Synaptics.exe	30
PID 2960 wrote to memory of 2828	2960	Synaptics.exe	30

C:\Users\Admin\AppData\Local\Temp\dm.exe
"C:\Users\Admin\AppData\Local\Temp\dm.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\._cache_dm.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_dm.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2360
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.7MB

MD5
4732b427adf5a2856c1b35b528393f9c

SHA1
784fa6ee208239cf4a49b13adf0e906f292017d7

SHA256
de428d7f626437a5251cd34820ccb446d122ccf6bf2cb9f5c4c941de46c559b7

SHA512
b46d20a0219351f0fede70cb7e927da1af1f369089c4a2c00299962fd0368b7383373b10cc84f7fe7fcd24aa3a88c56c2ce7f4e23421783bbf02bfa6d3287e22

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_dm.exe

Filesize
1.0MB

MD5
7db1df6452522d3ae275c8015bafb38f

SHA1
1de76c306de88d7a7c2bbf3fab76d68fe9b05e52

SHA256
01fef590b8f2f6ead4e010feebf2533b35c941e6aaa687168683d92e40834756

SHA512
f54bb8aa409505c7a6641538386e88efb4ec87526d4f305a90384318b45b0edf15c48e6540ecf0ed26e02815507841f24df93f55c7157775976bbe3b49ec8787

Download Submit
memory/2360-32-0x0000000000250000-0x000000000025F000-memory.dmp

Filesize
60KB

Download
memory/2828-43-0x0000000000250000-0x000000000025F000-memory.dmp

Filesize
60KB

Download
memory/2960-29-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2960-44-0x0000000000400000-0x00000000005C5000-memory.dmp

Filesize
1.8MB

Download
memory/2960-45-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2960-54-0x0000000000400000-0x00000000005C5000-memory.dmp

Filesize
1.8MB

Download
memory/2960-76-0x0000000000400000-0x00000000005C5000-memory.dmp

Filesize
1.8MB

Download
memory/3048-0-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/3048-28-0x0000000000400000-0x00000000005C5000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads