Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-11-2024 23:24

General

  • Target

    f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca.exe

  • Size

    3.0MB

  • MD5

    66d21c7e8b619bd90c281df45cf2ed86

  • SHA1

    295631560c1ac8104fe8427de898d043921c42af

  • SHA256

    f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca

  • SHA512

    5823942b7c784f35a5defb565a69ad7a58545a102b9d68ed72c710846308ef30297976902eb9d9bf271152d81bd364aba7d6ef0408ccdd8a39c2262343ee245e

  • SSDEEP

    49152:KnsHyjtk2MYC5GDRARtcS4sGmG/E8gglu9mPKG34dOTTtDYd8xX56W2ohUZi5mqr:Knsmtk2aZRtQsGmdXkSG3tYO/NUZZqwS

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 11 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca.exe
    "C:\Users\Admin\AppData\Local\Temp\f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Users\Admin\AppData\Local\Temp\._cache_f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Users\Admin\AppData\Local\Temp\is-F5K04.tmp\._cache_f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-F5K04.tmp\._cache_f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca.tmp" /SL5="$70158,1955946,120832,C:\Users\Admin\AppData\Local\Temp\._cache_f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2744
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1824
        • C:\Users\Admin\AppData\Local\Temp\is-11BOF.tmp\._cache_Synaptics.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-11BOF.tmp\._cache_Synaptics.tmp" /SL5="$8015A,1955946,120832,C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:296
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    3.0MB

    MD5

    66d21c7e8b619bd90c281df45cf2ed86

    SHA1

    295631560c1ac8104fe8427de898d043921c42af

    SHA256

    f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca

    SHA512

    5823942b7c784f35a5defb565a69ad7a58545a102b9d68ed72c710846308ef30297976902eb9d9bf271152d81bd364aba7d6ef0408ccdd8a39c2262343ee245e

  • C:\Users\Admin\AppData\Local\Temp\ewnldiSO.xlsm

    Filesize

    17KB

    MD5

    af4d37aad8b34471da588360a43e768a

    SHA1

    83ed64667d4e68ea531b8bcf58aab3ed4a5ca998

    SHA256

    e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1

    SHA512

    74f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da

  • C:\Users\Admin\AppData\Local\Temp\is-F5K04.tmp\._cache_f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca.tmp

    Filesize

    1.1MB

    MD5

    e30f67f2e5f8fad9be36605c26b46020

    SHA1

    0fd821dba20b85316d052d3930879b946222ce92

    SHA256

    af591c283811b99db7639a11a1e04ebc71f9fdeac5462bd6e98bdc4410be6042

    SHA512

    ebacecef67c9247b1a6b3bf87553f71689c692adbca711aca270f062a5ae2eba28a1781282e4102df11599a9393eec75b22e983ff2524d35287645561f43188a

  • \Users\Admin\AppData\Local\Temp\._cache_f06a6509c05003a77e6e54cf0d464f88528a7dc50d564d1bb9b46b043c6db9ca.exe

    Filesize

    2.3MB

    MD5

    67781d1aaccf58665ee1d3e1846ad3b8

    SHA1

    769bfc74dbae2e2851f7a1c731d833ff9d7ed228

    SHA256

    5f42d76212e6f0dc625e0e19dd532651daa1afb9f3a0ef428d3a6121eb97f16f

    SHA512

    e1893bde32be094c8a29370d7a31451f52afb80721f14e3fa48fff80bb0926cecb6a7aedac91635f1a42dc11af4da3bb9f4030ad947c2f8d85a0c35e3eaf3696

  • \Users\Admin\AppData\Local\Temp\is-K57EN.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • memory/296-70-0x0000000000400000-0x000000000052B000-memory.dmp

    Filesize

    1.2MB

  • memory/1824-50-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1824-72-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2680-20-0x0000000000401000-0x0000000000412000-memory.dmp

    Filesize

    68KB

  • memory/2680-17-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2680-73-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2740-122-0x0000000000400000-0x0000000000707000-memory.dmp

    Filesize

    3.0MB

  • memory/2740-78-0x0000000000400000-0x0000000000707000-memory.dmp

    Filesize

    3.0MB

  • memory/2740-75-0x0000000000400000-0x0000000000707000-memory.dmp

    Filesize

    3.0MB

  • memory/2744-74-0x0000000000400000-0x000000000052B000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-90-0x0000000000400000-0x000000000052B000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-77-0x0000000000400000-0x000000000052B000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-133-0x0000000000400000-0x000000000052B000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-80-0x0000000000400000-0x000000000052B000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-83-0x0000000000400000-0x000000000052B000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-86-0x0000000000400000-0x000000000052B000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-130-0x0000000000400000-0x000000000052B000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-121-0x0000000000400000-0x000000000052B000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-127-0x0000000000400000-0x000000000052B000-memory.dmp

    Filesize

    1.2MB

  • memory/2744-124-0x0000000000400000-0x000000000052B000-memory.dmp

    Filesize

    1.2MB

  • memory/2856-40-0x0000000000400000-0x0000000000707000-memory.dmp

    Filesize

    3.0MB

  • memory/2856-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/3064-64-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB