xred | b5b1f5fa5d43d0deddd368f6a16000a21e2fd1b6a7a2616acf0710fd30b7062e

General

Target

Temp + Perm (1).exe
Size

2.5MB
MD5

21f6c0f608202615f141499e0b9238f8
SHA1

29b41725e9a3b6f4f4ab3eb4b444c7fa6bfc84ef
SHA256

b5b1f5fa5d43d0deddd368f6a16000a21e2fd1b6a7a2616acf0710fd30b7062e
SHA512

9221f37decf63c0e814527a96aaba65aa907a62474c631c2f9f1ce0b220f6409614af5d9ca81d956da8bec39eec06cd2eaa3684b22f4398dd411cb7ce2615320
SSDEEP

49152:+nsHyjtk2MYC5GDu0C2lkASpEITYbNbNWo4kSH3OqtwImAanC:+nsmtk2aWCKkRpEIT4bNJFY3Oqt6AWC

Score

10^/10

xred backdoor discovery macro persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

Processes:

resource
C:\Users\Admin\AppData\Local\Temp\NLzY4TFH.xlsm

Executes dropped EXE 3 IoCs

Processes:

._cache_Temp + Perm (1).exeSynaptics.exe._cache_Synaptics.exe

pid process

2768 ._cache_Temp + Perm (1).exe
2724 Synaptics.exe
2668 ._cache_Synaptics.exe
Loads dropped DLL 5 IoCs

Processes:

Temp + Perm (1).exeSynaptics.exe

pid process

2636 Temp + Perm (1).exe
2636 Temp + Perm (1).exe
2636 Temp + Perm (1).exe
2724 Synaptics.exe
2724 Synaptics.exe

pid	process
2768	._cache_Temp + Perm (1).exe
2724	Synaptics.exe
2668	._cache_Synaptics.exe

pid	process
2636	Temp + Perm (1).exe
2636	Temp + Perm (1).exe
2636	Temp + Perm (1).exe
2724	Synaptics.exe
2724	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Temp + Perm (1).exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Temp + Perm (1).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

._cache_Temp + Perm (1).exeSynaptics.exe._cache_Synaptics.exeEXCEL.EXETemp + Perm (1).exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Temp + Perm (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp + Perm (1).exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

._cache_Synaptics.exeEXCEL.EXE._cache_Temp + Perm (1).exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_Temp + Perm (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_Temp + Perm (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_Temp + Perm (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2028 EXCEL.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EXCEL.EXE

pid process

2028 EXCEL.EXE

pid	process
2028	EXCEL.EXE

pid	process
2028	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Temp + Perm (1).exeSynaptics.exe

description	pid	process	target process
PID 2636 wrote to memory of 2768	2636	Temp + Perm (1).exe	._cache_Temp + Perm (1).exe
PID 2636 wrote to memory of 2768	2636	Temp + Perm (1).exe	._cache_Temp + Perm (1).exe
PID 2636 wrote to memory of 2768	2636	Temp + Perm (1).exe	._cache_Temp + Perm (1).exe
PID 2636 wrote to memory of 2768	2636	Temp + Perm (1).exe	._cache_Temp + Perm (1).exe
PID 2636 wrote to memory of 2724	2636	Temp + Perm (1).exe	Synaptics.exe
PID 2636 wrote to memory of 2724	2636	Temp + Perm (1).exe	Synaptics.exe
PID 2636 wrote to memory of 2724	2636	Temp + Perm (1).exe	Synaptics.exe
PID 2636 wrote to memory of 2724	2636	Temp + Perm (1).exe	Synaptics.exe
PID 2724 wrote to memory of 2668	2724	Synaptics.exe	._cache_Synaptics.exe
PID 2724 wrote to memory of 2668	2724	Synaptics.exe	._cache_Synaptics.exe
PID 2724 wrote to memory of 2668	2724	Synaptics.exe	._cache_Synaptics.exe
PID 2724 wrote to memory of 2668	2724	Synaptics.exe	._cache_Synaptics.exe

C:\Users\Admin\AppData\Local\Temp\Temp + Perm (1).exe
"C:\Users\Admin\AppData\Local\Temp\Temp + Perm (1).exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Users\Admin\AppData\Local\Temp\._cache_Temp + Perm (1).exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_Temp + Perm (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:2768
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:2668

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
2.5MB

MD5
21f6c0f608202615f141499e0b9238f8

SHA1
29b41725e9a3b6f4f4ab3eb4b444c7fa6bfc84ef

SHA256
b5b1f5fa5d43d0deddd368f6a16000a21e2fd1b6a7a2616acf0710fd30b7062e

SHA512
9221f37decf63c0e814527a96aaba65aa907a62474c631c2f9f1ce0b220f6409614af5d9ca81d956da8bec39eec06cd2eaa3684b22f4398dd411cb7ce2615320

Download Submit
C:\Users\Admin\AppData\Local\Temp\NLzY4TFH.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\NLzY4TFH.xlsm

Filesize
20KB

MD5
86ec68000738a6e0b04d5eb0a729c6ee

SHA1
1e9c9f8dccb264fce82af91210c2793b051cedd1

SHA256
4eee19fc314a27e079450f4dbae104327c9e869b4039997c208026b6fca4c546

SHA512
9bebfb80e241703155628929a5ca57517161209b2da87413d6a0114abe1d146f6cd2291bef95d0f8ba4b99944ffa4f293b0737133716335714d3321afb12ade2

Download Submit
C:\Users\Admin\AppData\Local\Temp\NLzY4TFH.xlsm

Filesize
24KB

MD5
537f0c36fe9e33ed640a680c4be8714a

SHA1
1e4fd3f0e30e17bc2c96169f6ca98e5b41fc8326

SHA256
4b68a5e1b0a284bec9c225802ec07bb6872f84742cc33840dfc45b95e04084e6

SHA512
d66323691e7a5c7594fe0fc4c3805ceddbaa6362f0202fd3e63918b8dd3bc7e8f37b6c9f22f4c1f0fbfb7ffa07f9b080e7a5c7911fa05a0c713d85e4df7af623

Download Submit
C:\Users\Admin\AppData\Local\Temp\NLzY4TFH.xlsm

Filesize
23KB

MD5
9a4a8e3dbb1cd6bbc69d4b6792acee79

SHA1
28d98c584c51efeabeb130d460ed952f354ef341

SHA256
a6f4694320870cb4d95aaa0da24f3c66a309672242f956ee06a3ae054f29c6ca

SHA512
7cd6fbe1df2e1dcb9cb66d0490dfc217e05a02ee78838086e1cee271b4212c5026efc4c34336f0a5c7b81ae16696eada4b6aa9cb6da5a55607acc2c2d6172d36

Download Submit
C:\Users\Admin\AppData\Local\Temp\NLzY4TFH.xlsm

Filesize
28KB

MD5
978abdaf22e8fcf5c5c6116993c05a1d

SHA1
54eaf0715afd07903a27ca320602384d9d64347b

SHA256
831ac163fa9b6a1b0ed6b797ea961f66d91de8807bdd198343f93fcf7b27a614

SHA512
d95f405495514f2ccc74b00dcc88c5946afff213dd8950bad03edda8318d9aa7dc9281e0176b520909f6f6eafdea2a0958562be5f258429859c26884122d51ee

Download Submit
C:\Users\Admin\Documents\~$UsePush.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_Temp + Perm (1).exe

Filesize
1.8MB

MD5
02e2011ab01fac81d4b8b2097f488ca1

SHA1
5539e5a7b7ee674f06810b9e8d0ba67872491573

SHA256
cd7e41494768b82ddb16d6dc97f90f75600424bf18e8b05f5ce007e9d136b38e

SHA512
89feb543037b7cb5f999767864741798820f0198995380b348a7e18d6e88209e3fc3a69a5a6dd28f93383a84eb636a3ac3bd5fdf5f2d8f4658a0b91415b90086

Download Submit
memory/2028-37-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2636-25-0x0000000000400000-0x000000000068B000-memory.dmp

Filesize
2.5MB

Download
memory/2636-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2668-52-0x0000000000F20000-0x00000000010F0000-memory.dmp

Filesize
1.8MB

Download
memory/2668-90-0x0000000004F50000-0x0000000005164000-memory.dmp

Filesize
2.1MB

Download
memory/2724-116-0x0000000000400000-0x000000000068B000-memory.dmp

Filesize
2.5MB

Download
memory/2724-151-0x0000000000400000-0x000000000068B000-memory.dmp

Filesize
2.5MB

Download
memory/2768-53-0x0000000001120000-0x00000000012F0000-memory.dmp

Filesize
1.8MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads