xred | b5b1f5fa5d43d0deddd368f6a16000a21e2fd1b6a7a2616acf0710fd30b7062e

General

Target

Temp + Perm (1).exe
Size

2.5MB
MD5

21f6c0f608202615f141499e0b9238f8
SHA1

29b41725e9a3b6f4f4ab3eb4b444c7fa6bfc84ef
SHA256

b5b1f5fa5d43d0deddd368f6a16000a21e2fd1b6a7a2616acf0710fd30b7062e
SHA512

9221f37decf63c0e814527a96aaba65aa907a62474c631c2f9f1ce0b220f6409614af5d9ca81d956da8bec39eec06cd2eaa3684b22f4398dd411cb7ce2615320
SSDEEP

49152:+nsHyjtk2MYC5GDu0C2lkASpEITYbNbNWo4kSH3OqtwImAanC:+nsmtk2aWCKkRpEIT4bNJFY3Oqt6AWC

Score

10^/10

xred backdoor discovery macro persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Suspicious Office macro 2 IoCs

Office document equipped with macros.

macro

Processes:

resource
C:\Users\Admin\AppData\Local\Temp\sHhXkxHT.xlsm
C:\Users\Admin\AppData\Local\Temp\sHhXkxHT.xlsm

Executes dropped EXE 3 IoCs

Processes:

._cache_Temp + Perm (1).exeSynaptics.exe._cache_Synaptics.exe

pid process

2720 ._cache_Temp + Perm (1).exe
2596 Synaptics.exe
2632 ._cache_Synaptics.exe
Loads dropped DLL 5 IoCs

Processes:

Temp + Perm (1).exeSynaptics.exe

pid process

2672 Temp + Perm (1).exe
2672 Temp + Perm (1).exe
2672 Temp + Perm (1).exe
2596 Synaptics.exe
2596 Synaptics.exe

pid	process
2720	._cache_Temp + Perm (1).exe
2596	Synaptics.exe
2632	._cache_Synaptics.exe

pid	process
2672	Temp + Perm (1).exe
2672	Temp + Perm (1).exe
2672	Temp + Perm (1).exe
2596	Synaptics.exe
2596	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Temp + Perm (1).exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Temp + Perm (1).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Temp + Perm (1).exe._cache_Temp + Perm (1).exeSynaptics.exe._cache_Synaptics.exeEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp + Perm (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Temp + Perm (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

._cache_Temp + Perm (1).exeEXCEL.EXE._cache_Synaptics.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_Temp + Perm (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_Temp + Perm (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_Temp + Perm (1).exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3044 EXCEL.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EXCEL.EXE

pid process

3044 EXCEL.EXE

pid	process
3044	EXCEL.EXE

pid	process
3044	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Temp + Perm (1).exeSynaptics.exe

description	pid	process	target process
PID 2672 wrote to memory of 2720	2672	Temp + Perm (1).exe	._cache_Temp + Perm (1).exe
PID 2672 wrote to memory of 2720	2672	Temp + Perm (1).exe	._cache_Temp + Perm (1).exe
PID 2672 wrote to memory of 2720	2672	Temp + Perm (1).exe	._cache_Temp + Perm (1).exe
PID 2672 wrote to memory of 2720	2672	Temp + Perm (1).exe	._cache_Temp + Perm (1).exe
PID 2672 wrote to memory of 2596	2672	Temp + Perm (1).exe	Synaptics.exe
PID 2672 wrote to memory of 2596	2672	Temp + Perm (1).exe	Synaptics.exe
PID 2672 wrote to memory of 2596	2672	Temp + Perm (1).exe	Synaptics.exe
PID 2672 wrote to memory of 2596	2672	Temp + Perm (1).exe	Synaptics.exe
PID 2596 wrote to memory of 2632	2596	Synaptics.exe	._cache_Synaptics.exe
PID 2596 wrote to memory of 2632	2596	Synaptics.exe	._cache_Synaptics.exe
PID 2596 wrote to memory of 2632	2596	Synaptics.exe	._cache_Synaptics.exe
PID 2596 wrote to memory of 2632	2596	Synaptics.exe	._cache_Synaptics.exe

C:\Users\Admin\AppData\Local\Temp\Temp + Perm (1).exe
"C:\Users\Admin\AppData\Local\Temp\Temp + Perm (1).exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\._cache_Temp + Perm (1).exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_Temp + Perm (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:2720
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:2632

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
2.5MB

MD5
21f6c0f608202615f141499e0b9238f8

SHA1
29b41725e9a3b6f4f4ab3eb4b444c7fa6bfc84ef

SHA256
b5b1f5fa5d43d0deddd368f6a16000a21e2fd1b6a7a2616acf0710fd30b7062e

SHA512
9221f37decf63c0e814527a96aaba65aa907a62474c631c2f9f1ce0b220f6409614af5d9ca81d956da8bec39eec06cd2eaa3684b22f4398dd411cb7ce2615320

Download Submit
C:\Users\Admin\AppData\Local\Temp\sHhXkxHT.xlsm

Filesize
25KB

MD5
9b1fefc968f66464af1c0b94203684d9

SHA1
4881ad0b08ab5ba26258f9029ad043f0bf2e3cf8

SHA256
7443379697966678dd17889a371b19874d9bb1384491071587d2d646c6e9d00a

SHA512
34159789f0a70eed48f7f58ec28b2941274283184721cf7bc1aa0dfbb84991390e09fa2f385a5499efabdb467224bbb4c99127b2c2a7d36b7030c495a6f905bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\sHhXkxHT.xlsm

Filesize
21KB

MD5
d5113f05b8e5cc72e927a740b4d059c1

SHA1
044bc3724b4448193cffc884b2a94a7726965bcd

SHA256
262552425b1b8d38df5d77dedcf98ed639b14b9a6cda96f4499f2345e3261d14

SHA512
1529b6238da97b62ca1fad391588e11acee671f6997c853ff92d4f2b373016fb11818c3e9333423f4fc2c44295c956961f97b609fbd160f7b1ad7c07ef340402

Download Submit
C:\Users\Admin\AppData\Local\Temp\sHhXkxHT.xlsm

Filesize
27KB

MD5
4da929c8eedba425ebd19abc9124856a

SHA1
9eb87a74b4c61ab6a40d79f1656cbd8e5b711a5f

SHA256
78fab17de0749d35f5077b10a22ba4afdee8d2e03579451b2a96072bd4aa46ef

SHA512
1a54378065f54983b69133ecf84f55f6f91a19fa137f2c1d933432e5e485bc33c0f4a08f8797158709852761e722de6d369d12d7e42e593f3e356d94b27ea5bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\sHhXkxHT.xlsm

Filesize
25KB

MD5
0fee93d73d8e8091b5d1d5e32ef103b1

SHA1
164abb018e3b7e39a79338641f4823337331b1eb

SHA256
01df6c8ad46dfb63b30431800631a0f61c9206af76880b4fc1cf1c96fa79df15

SHA512
d775f8673de0d6ab0d0c8cba1109c3b2aaa2fd24bec3ad01eac8046e6b334cde25712e53c35620e2bc647b4a4b181acae4e4feaaf64d45d64e564c0bf1a86f6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sHhXkxHT.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\~$sHhXkxHT.xlsm

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_Temp + Perm (1).exe

Filesize
1.8MB

MD5
02e2011ab01fac81d4b8b2097f488ca1

SHA1
5539e5a7b7ee674f06810b9e8d0ba67872491573

SHA256
cd7e41494768b82ddb16d6dc97f90f75600424bf18e8b05f5ce007e9d136b38e

SHA512
89feb543037b7cb5f999767864741798820f0198995380b348a7e18d6e88209e3fc3a69a5a6dd28f93383a84eb636a3ac3bd5fdf5f2d8f4658a0b91415b90086

Download Submit
memory/2596-115-0x0000000000400000-0x000000000068B000-memory.dmp

Filesize
2.5MB

Download
memory/2596-150-0x0000000000400000-0x000000000068B000-memory.dmp

Filesize
2.5MB

Download
memory/2632-40-0x0000000005270000-0x0000000005484000-memory.dmp

Filesize
2.1MB

Download
memory/2632-38-0x0000000001300000-0x00000000014D0000-memory.dmp

Filesize
1.8MB

Download
memory/2672-0-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2672-26-0x0000000000400000-0x000000000068B000-memory.dmp

Filesize
2.5MB

Download
memory/2720-29-0x0000000000A50000-0x0000000000C20000-memory.dmp

Filesize
1.8MB

Download
memory/3044-39-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/3044-114-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads