Analysis
-
max time kernel
112s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
submitted
02-10-2024 01:22
General
-
Target
60e26db1295e761743202849b2fc4e658997e1d6e427336fcd2ebedb344f3c3eN.exe
-
Size
3.8MB
-
MD5
b76ee79acb617308714ce10c9694aaf0
-
SHA1
96463bbfc64d062ae413944d54de71d032cfdb28
-
SHA256
60e26db1295e761743202849b2fc4e658997e1d6e427336fcd2ebedb344f3c3e
-
SHA512
0a1c786c5d89532378a74444c92cf30b3e9cdc2902d4a3db25a007f04c2a1ed5d2f8038fcf9ae44517035c94c09fbb039e86d5729e8f59e5fcbab3ad1ac77f04
-
SSDEEP
49152:RnsHyjtk2MYC5GDou5ThGzaxEueKvnGrskbj4Vp75Y:Rnsmtk2awTc8G3om
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 20 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\60e26db1295e761743202849b2fc4e658997e1d6e427336fcd2ebedb344f3c3eN.exe"C:\Users\Admin\AppData\Local\Temp\60e26db1295e761743202849b2fc4e658997e1d6e427336fcd2ebedb344f3c3eN.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_60e26db1295e761743202849b2fc4e658997e1d6e427336fcd2ebedb344f3c3eN.exe"C:\Users\Admin\AppData\Local\Temp\._cache_60e26db1295e761743202849b2fc4e658997e1d6e427336fcd2ebedb344f3c3eN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
MD5b76ee79acb617308714ce10c9694aaf0
SHA196463bbfc64d062ae413944d54de71d032cfdb28
SHA25660e26db1295e761743202849b2fc4e658997e1d6e427336fcd2ebedb344f3c3e
SHA5120a1c786c5d89532378a74444c92cf30b3e9cdc2902d4a3db25a007f04c2a1ed5d2f8038fcf9ae44517035c94c09fbb039e86d5729e8f59e5fcbab3ad1ac77f04
-
Filesize
1KB
MD508db4071e3953bfed5cfe4775879f2f2
SHA1838e599002ca3974c1f1b35daf5b58d18b5f419f
SHA2566fe1f2c29e61ba25cbd59ffdd988a6f2a9c1a66de40be93bf32ae1d6be5b1919
SHA512cba8ec11a755a97853b95b88d60b1488afd75012dd9d9971abbf816ae2d46b6f34b88394feb980f3067b5d2a8a50e597b6ec7f421823f1864144bad863c67486
-
Filesize
943B
MD5cfb32b6f8e8bb8381f0e3983c1dc0e38
SHA1806770b83e32d682d6980b331666790b0a1732d4
SHA25684a6fd1db7591dfdadcbf25bba043088be5077064d4e0f375769d38f2ad8d078
SHA512a2722af3e4f6a92690a73e5e1a02445c84704d1db967ba1aa81a1b9ca77a25b9969b1d686fbb41c18330f4f568e2d7ab44d4af6890fd1385cbcf41ff1287c112
-
Filesize
1KB
MD5515a6495ab331fa1383ce7753c040988
SHA1e55dc6f0b3666caafc8b6259ccb3381f3119aea7
SHA2568841330a1bcbc4c413eb5ae8630f3be3eb92bc7dd38f4d5a21b0e086f5d037fd
SHA512af138f9995f398da4ed05bbb92a1f043a19b60e2002860b6f34c701d788c36b3ccb35e8e6684fc7553c97f5f61529fd9651b6bea50411b97a89373b6e5dbcf7b
-
Filesize
826B
MD51369b36b1e24dda53ab870bab91a9b7a
SHA194bbad89cabea6fd15a2152db076f03bc54c6c30
SHA256105e6e88d2db4c7bcc084b871c03cf3fa8bbdc269a797b6c67cca65b2569fdee
SHA512b4549c593051d0eaeb82b70ba21fbaf0b14b199148de8920d12efd2d395c5eac7a15fca0ff98f4e63a2da12cb4a52a7bebb4e182a0a2de6b72e2abeaebd86cb5
-
Filesize
1KB
MD52c956fcc54c53d8406e46eb24755aa68
SHA127406ecb7bb1687c0584e2df958ec5bc809c0a31
SHA256981b0d70904ecacd849a783b4a0d086186bd27c492d1866dd063773143dc37d6
SHA51244fe228b4bd9a07661c8e18e5c7756641124ae68151230407e70fb64ca1190c5c3c388c826c1f5b71c34269b94fcf2b1aecd527b12338418e293d405dfa050b4
-
Filesize
1KB
MD53ea62c30c3928984b884572878793b79
SHA17affa7058101ba2a6f49bdfde7e822b08fc72bd6
SHA25679e00e37d13bd0705ee72b44d8753e25673a9382443f6992ed2271d49771ff3f
SHA512f28189829bd3c000bb0db66af98eafe03f99c7b3bf6ce70c4b84d1b5bdfafd3f90725e4fb17c91d3296237402bcbd6e9ab6a33e8637faf9342af20df948583c0
-
Filesize
1KB
MD525f1c02a1633a51d564f4798f424748d
SHA1356b9379a9ca7c7ca7b11bd8ec60c16127e4fd6e
SHA256c94adb4d0178c01588106120c6d2fb320e6442490ec30c4e8da2eb69202da240
SHA51295356a0b1d198456991bb80c1e9fb11f8e95ec794954a0c187af1036151be9a0d3911b9295c663bbc394541c53e60bc3862f41a702755b48ceef17ff597a5e2e
-
Filesize
3.1MB
MD502512e38b0f784ebc127491794e6a238
SHA17a6e1e4c67cc88a36e6aec1cccd90d17d21be912
SHA2565053526830ba1c5e84dda69646140fa85a293cd874c9c2f5ea13a31728ed29ab
SHA5121515a51eef71814c0f7be05ee62b31734827fd28979eb9fd48f78b394bfc0df2e3d0a4ab5e472724111bc18a9cb0bf62ef7cb4f6346b85292e1e79ef980ebe75
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
24KB
MD57a97d01533defe969c5854c4ec608b29
SHA185eaead658287a55ecef5f846a6a8cb21e33a914
SHA25636f00c69beee75aa9ccf031946ad02b95e7a2d2492f5117ca21ac034a12fda1b
SHA512d940c54cf82f3b5506f18257980f0d321f8f0292b19ec03b297f725f9acc8581c592fb31df1c6ada01a3668cbddd34cb1ee763b4940bd087055318d4a07dfaf6
-
Filesize
1KB
MD5548477e77506fedb57f141def1bcaaa1
SHA187653dd2952188b9aac16683e52bd9f8fca8374f
SHA2563a6788e8d6124f16a3d0055a9ccbe4f1c9ff52521399a3353c62655a48a8f4ff
SHA512ee4668ed7888b6d736a0b52f4af67a28466f479cc362284a395a11520f09063a1976e066bbc5be81a7687e2a461901f5e9a77e3d47961e517df9adff460d7513
-
Filesize
1KB
MD5b22174e3719df146c34a7f72b90e8a2c
SHA10d308a4b893d0cdfb9a69bcf4a34706d05099509
SHA2568c1780596398390b142717b71cdf8876d316a714747fa97411d54a727360ea4a
SHA512a82fb93fbdb6c4e48f667717af93e0bc71d33850e2721813ab39ab4795d0414efb89f28a01784611d693a085c2ceb3cb359182ce9aac053092162f2a2531d1bf
-
Filesize
1KB
MD5a00e689adbde24aeb5e7576664f99169
SHA184fd48e080e96f604e8c5f48bbea3536dc9b5ecb
SHA256235dda27a44f482b2f045278bc40eb8abc07dc667b51b28991e97dc27c12a54d
SHA512354743879e49ea223f423a846f86331bf58150f0b2f4408ccdd62b73dcec6bb5b2ac7a26c00cdf0dc5ed07d02b5dadb3f1c0430b5382e6b0943e44f44ceec129
-
Filesize
1KB
MD5085ab646e9983776b0f558885e4310ee
SHA1b697c6620576e0d4d82f93c3baeeea39a10801f4
SHA256c484f006e6ad0768d23bce6adf020c0ebf562bf4bb1a917de7ea5ad27a9fe6d5
SHA512ef3ae2d29443aa419b71c64be1522f00bb87409483b60ff5dc39377e3237762c09b4feac6805e3249ffe895828cf79b0c316a17140e8eddaeb80b30dcf415d9b
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
832KB
-
Filesize
504KB
-
Filesize
1.3MB
-
Filesize
832KB
-
Filesize
280KB
-
Filesize
1.3MB
-
Filesize
504KB
-
Filesize
1.3MB
-
Filesize
32KB
-
Filesize
280KB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
3.9MB
-
Filesize
1.3MB
-
Filesize
280KB
-
Filesize
832KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
32KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
256KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
504KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
216KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
504KB
-
Filesize
64KB
-
Filesize
3.9MB