Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • submitted
    28/05/2024, 05:07

General

  • Target

    33ce682b31ee30c6773d02f3bc970540_NeikiAnalytics.exe

  • Size

    2.8MB

  • MD5

    33ce682b31ee30c6773d02f3bc970540

  • SHA1

    247d8783bde45b2211d390f8cbfd81c24e9319d9

  • SHA256

    89f96124a7cd11d732b32d8a6f4a94bd03ae024649e45de1011a89ac58f1adcb

  • SHA512

    96fb0586341f60995e5ea39798dd5d902c4f94f3e50a08a51361f1427873e2c091a4d9272c6053d6c2cc25a887335a58d0fba6636c1bd3c7e5694ef0142e95d8

  • SSDEEP

    49152:WnsHyjtk2MYC5GD9Z+vV8hVDXl+0b+0V2T7q9LCMiP8XnYZq0z21hjH5fa00hXjS:Wnsmtk2aTIDXl+0q0ogCMiP8XYZq0z2X

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33ce682b31ee30c6773d02f3bc970540_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\33ce682b31ee30c6773d02f3bc970540_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Users\Admin\AppData\Local\Temp\._cache_33ce682b31ee30c6773d02f3bc970540_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_33ce682b31ee30c6773d02f3bc970540_NeikiAnalytics.exe"
      2⤵
      • Executes dropped EXE
      PID:2848
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        PID:2584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    2.8MB

    MD5

    33ce682b31ee30c6773d02f3bc970540

    SHA1

    247d8783bde45b2211d390f8cbfd81c24e9319d9

    SHA256

    89f96124a7cd11d732b32d8a6f4a94bd03ae024649e45de1011a89ac58f1adcb

    SHA512

    96fb0586341f60995e5ea39798dd5d902c4f94f3e50a08a51361f1427873e2c091a4d9272c6053d6c2cc25a887335a58d0fba6636c1bd3c7e5694ef0142e95d8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • \Users\Admin\AppData\Local\Temp\._cache_33ce682b31ee30c6773d02f3bc970540_NeikiAnalytics.exe

    Filesize

    2.0MB

    MD5

    2a9a531bb9bb287edc6dfa6d2ad7de07

    SHA1

    0088d830559d55dee443e86e3f43e392d4b355e6

    SHA256

    49934fc00d3d418c67ab626735b0f7dbe37f9c07d28f7b149f1f7e4b7d299d8e

    SHA512

    c382eeb541215563d861331e5ef628ad12c413fe2d9e0f1ed6dccb26b4630558544e9bda5133c24a663888745e50293307b18ed748cbe3b16b95d30853377451

  • memory/2340-0-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2340-25-0x0000000000400000-0x00000000006C6000-memory.dmp

    Filesize

    2.8MB

  • memory/2776-35-0x0000000000400000-0x00000000006C6000-memory.dmp

    Filesize

    2.8MB

  • memory/2776-88-0x0000000000400000-0x00000000006C6000-memory.dmp

    Filesize

    2.8MB