xred | b5b1f5fa5d43d0deddd368f6a16000a21e2fd1b6a7a2616acf0710fd30b7062e

Resubmissions

11/11/2024, 02:18

241111-crlezstmdp10

11/11/2024, 02:10

241111-clr1kstlbq10

Analysis

max time kernel
48s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Temp + Perm (1).exe
Size 2.5MB
Sample241111-crlezstmdp
SHA256 b5b1f5fa5d43d0deddd368f6a16000a21e2fd1b6a7a2616acf0710fd30b7062e
MD5 21f6c0f608202615f141499e0b9238f8
SHA1 29b41725e9a3b6f4f4ab3eb4b444c7fa6bfc84ef
SHA512 9221f37decf63c0e814527a96aaba65aa907a62474c631c2f9f1ce0b220f6409614af5d9ca81d956da8bec39eec06cd2eaa3684b22f4398dd411cb7ce2615320
SSDEEP 49152:+nsHyjtk2MYC5GDu0C2lkASpEITYbNbNWo4kSH3OqtwImAanC:+nsmtk2aWCKkRpEIT4bNJFY3Oqt6AWC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Temp + Perm (1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 3 IoCs

pid	Process
4948	._cache_Temp + Perm (1).exe
3144	Synaptics.exe
1624	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Temp + Perm (1).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp + Perm (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Temp + Perm (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_Temp + Perm (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_Temp + Perm (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_Temp + Perm (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "46"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Temp + Perm (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4872	EXCEL.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4272	bootim.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	4272	bootim.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4872	EXCEL.EXE
4872	EXCEL.EXE
4872	EXCEL.EXE
4872	EXCEL.EXE
4872	EXCEL.EXE
4872	EXCEL.EXE
4872	EXCEL.EXE
4872	EXCEL.EXE
4264	LogonUI.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 4948	1148	Temp + Perm (1).exe	86
PID 1148 wrote to memory of 4948	1148	Temp + Perm (1).exe	86
PID 1148 wrote to memory of 4948	1148	Temp + Perm (1).exe	86
PID 1148 wrote to memory of 3144	1148	Temp + Perm (1).exe	87
PID 1148 wrote to memory of 3144	1148	Temp + Perm (1).exe	87
PID 1148 wrote to memory of 3144	1148	Temp + Perm (1).exe	87
PID 3144 wrote to memory of 1624	3144	Synaptics.exe	89
PID 3144 wrote to memory of 1624	3144	Synaptics.exe	89
PID 3144 wrote to memory of 1624	3144	Synaptics.exe	89

C:\Users\Admin\AppData\Local\Temp\Temp + Perm (1).exe
"C:\Users\Admin\AppData\Local\Temp\Temp + Perm (1).exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\._cache_Temp + Perm (1).exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_Temp + Perm (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:4948
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:1624

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4872

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b7855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4264

C:\Windows\system32\bootim.exe
bootim.exe /startpage:1
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 2.5MB
SHA256 b5b1f5fa5d43d0deddd368f6a16000a21e2fd1b6a7a2616acf0710fd30b7062e
MD5 21f6c0f608202615f141499e0b9238f8
SHA1 29b41725e9a3b6f4f4ab3eb4b444c7fa6bfc84ef
SHA512 9221f37decf63c0e814527a96aaba65aa907a62474c631c2f9f1ce0b220f6409614af5d9ca81d956da8bec39eec06cd2eaa3684b22f4398dd411cb7ce2615320
SSDEEP 49152:+nsHyjtk2MYC5GDu0C2lkASpEITYbNbNWo4kSH3OqtwImAanC:+nsmtk2aWCKkRpEIT4bNJFY3Oqt6AWC
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_Temp + Perm (1).exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_Temp + Perm (1).exe
Size 1.8MB
SHA256 cd7e41494768b82ddb16d6dc97f90f75600424bf18e8b05f5ce007e9d136b38e
MD5 02e2011ab01fac81d4b8b2097f488ca1
SHA1 5539e5a7b7ee674f06810b9e8d0ba67872491573
SHA512 89feb543037b7cb5f999767864741798820f0198995380b348a7e18d6e88209e3fc3a69a5a6dd28f93383a84eb636a3ac3bd5fdf5f2d8f4658a0b91415b90086
SSDEEP 49152:L0C2lkASpEITYbNbNWo4kSH3OqtwImAan:oCKkRpEIT4bNJFY3Oqt6AW
MD5 SHA1 SHA512 SSDEEP

Submit Download

15D75E00

Path C:\Users\Admin\AppData\Local\Temp\15D75E00
Size 26KB
SHA256 d4d38567016ad2ee9dfa7aa8398bf9be4a6bffe6d17d20a775c4c9d0b845afac
MD5 16a5f7fb135dd8954a84b1117d6cf45c
SHA1 960f8e0628e8baf1c8c373ebf979b0cd3a63a482
SHA512 dd206dff0499465cb8040e31e62d1643357140a91a4bb8d94e2aecaf2a34415464b9fb42a56468e29b1a5e9961e94c5bc1b62786b59f7f1693b880d36986c115
SSDEEP 768:MTC16k8+484o5bzTsArRAXu6x5V2ffxqhzHUvEJRGw6YYJCd+7H:MTC16k8+7BTJrRAu45VPhDUvEJRGwCb
MD5 SHA1 SHA512 SSDEEP

Submit Download

rXE1t4Lh.xlsm

Path C:\Users\Admin\AppData\Local\Temp\rXE1t4Lh.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1148-0-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/1148-129-0x0000000000400000-0x000000000068B000-memory.dmp

Download

memory/1624-227-0x0000000007120000-0x0000000007186000-memory.dmp

Download

memory/3144-132-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/3144-256-0x0000000000400000-0x000000000068B000-memory.dmp

Download

memory/3144-255-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/4872-203-0x00007FFFAE050000-0x00007FFFAE060000-memory.dmp

Download

memory/4872-202-0x00007FFFAE050000-0x00007FFFAE060000-memory.dmp

Download

memory/4872-199-0x00007FFFB0270000-0x00007FFFB0280000-memory.dmp

Download

memory/4872-198-0x00007FFFB0270000-0x00007FFFB0280000-memory.dmp

Download

memory/4872-197-0x00007FFFB0270000-0x00007FFFB0280000-memory.dmp

Download

memory/4872-200-0x00007FFFB0270000-0x00007FFFB0280000-memory.dmp

Download

memory/4872-201-0x00007FFFB0270000-0x00007FFFB0280000-memory.dmp

Download

memory/4948-138-0x00000000055B0000-0x00000000057C4000-memory.dmp

Download

memory/4948-137-0x00000000051F0000-0x00000000051FA000-memory.dmp

Download

memory/4948-136-0x0000000005230000-0x0000000005240000-memory.dmp

Download

memory/4948-135-0x00000000052E0000-0x0000000005372000-memory.dmp

Download

memory/4948-134-0x00000000057F0000-0x0000000005D94000-memory.dmp

Download

memory/4948-253-0x0000000072C9E000-0x0000000072C9F000-memory.dmp

Download

memory/4948-133-0x0000000000790000-0x0000000000960000-memory.dmp

Download

memory/4948-125-0x0000000072C9E000-0x0000000072C9F000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads