Analysis
-
max time kernel
158s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
submitted
07/05/2024, 20:17
General
-
Target
20fd25db10e8d5fb570b7582cdbd4d20_NEIKI.exe
-
Size
1.4MB
-
MD5
20fd25db10e8d5fb570b7582cdbd4d20
-
SHA1
6ef2020239fd2c8ae9d31339096951fe4f662fb9
-
SHA256
090ca23569c68ecd6ee85ea14983872e71f7e8a49461e12fb8f1a181a639fa99
-
SHA512
aab47f104202db23de760a1f8880c4d0cabac7e8ae7d588da7046db5122962b7a84d36edb5b1a97789f4ff6e0b143f5f879dfbe9773fa50e6b8e45a37e9e30a8
-
SSDEEP
24576:8nsJ39LyjbJkQFMhmC+6GD90MeM8Q/H/SgL+qg8ymnYsX9n75zWVA:8nsHyjtk2MYC5GDaMb86Rg8yqHd75zwA
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20fd25db10e8d5fb570b7582cdbd4d20_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\20fd25db10e8d5fb570b7582cdbd4d20_NEIKI.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_20fd25db10e8d5fb570b7582cdbd4d20_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\._cache_20fd25db10e8d5fb570b7582cdbd4d20_NEIKI.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD520fd25db10e8d5fb570b7582cdbd4d20
SHA16ef2020239fd2c8ae9d31339096951fe4f662fb9
SHA256090ca23569c68ecd6ee85ea14983872e71f7e8a49461e12fb8f1a181a639fa99
SHA512aab47f104202db23de760a1f8880c4d0cabac7e8ae7d588da7046db5122962b7a84d36edb5b1a97789f4ff6e0b143f5f879dfbe9773fa50e6b8e45a37e9e30a8
-
Filesize
646KB
MD56b5b089bed586552992a3b7083e7b7ad
SHA1815ba70695023f5a49598a5f439458a3e82ea349
SHA2562f786e22c71580539f5d6c7bf3064b2b75b72263fbe19565adf7e45a2b1f9467
SHA512b3e475546680428a9ec399d01d4e310de152b8102b9cae021c1a8c3e29a09c8ba2760e025f40294d6db455cb73c3d32be25845a3192272e770b5b130a764c9e9
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB