xred | fd59a4887d5b72ae931bc2c8d3e95a0bd856fbf1c3922331ef00a98ff77dfb9e

General

Target

dllArena.exe
Size

8.4MB
MD5

b8849b60e1823b0cb7368b56a61c7743
SHA1

caa74767470173e44edc33dea3e604fe2620a720
SHA256

fd59a4887d5b72ae931bc2c8d3e95a0bd856fbf1c3922331ef00a98ff77dfb9e
SHA512

121a100f36184d885517153d94da3bf95a7fc96ea95d12f58addfd7847c9697ea80641316efcfda102ef49170aecb4075cc3dad24b213f3d326eabd13d09e6dd
SSDEEP

196608:2LvgQdj4O9LgRRHG94UEbrURbsvnEJlQ9BWg:2LdX2RRmqUEbwRbsvnIG9BWg

Score

10^/10

xred backdoor discovery macro persistence upx

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x00070000000187a2-72.dat

Executes dropped EXE 7 IoCs

pid	Process
2564	._cache_dllArena.exe
2640	Synaptics.exe
2444	._cache_Synaptics.exe
2312	Built.exe
2384	dllArena.exe
2820	Built.exe
1236	Process not Found

Loads dropped DLL 10 IoCs

pid	Process
2984	dllArena.exe
2984	dllArena.exe
2984	dllArena.exe
2640	Synaptics.exe
2640	Synaptics.exe
2564	._cache_dllArena.exe
2564	._cache_dllArena.exe
2312	Built.exe
2820	Built.exe
1236	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	dllArena.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000194df-114.dat	upx
behavioral1/memory/2820-116-0x000007FEF23B0000-0x000007FEF2998000-memory.dmp	upx
behavioral1/memory/2820-120-0x000007FEF23B0000-0x000007FEF2998000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllArena.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2540	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2540	EXCEL.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2564	2984	dllArena.exe	29
PID 2984 wrote to memory of 2564	2984	dllArena.exe	29
PID 2984 wrote to memory of 2564	2984	dllArena.exe	29
PID 2984 wrote to memory of 2564	2984	dllArena.exe	29
PID 2984 wrote to memory of 2640	2984	dllArena.exe	30
PID 2984 wrote to memory of 2640	2984	dllArena.exe	30
PID 2984 wrote to memory of 2640	2984	dllArena.exe	30
PID 2984 wrote to memory of 2640	2984	dllArena.exe	30
PID 2640 wrote to memory of 2444	2640	Synaptics.exe	31
PID 2640 wrote to memory of 2444	2640	Synaptics.exe	31
PID 2640 wrote to memory of 2444	2640	Synaptics.exe	31
PID 2640 wrote to memory of 2444	2640	Synaptics.exe	31
PID 2564 wrote to memory of 2312	2564	._cache_dllArena.exe	33
PID 2564 wrote to memory of 2312	2564	._cache_dllArena.exe	33
PID 2564 wrote to memory of 2312	2564	._cache_dllArena.exe	33
PID 2564 wrote to memory of 2384	2564	._cache_dllArena.exe	34
PID 2564 wrote to memory of 2384	2564	._cache_dllArena.exe	34
PID 2564 wrote to memory of 2384	2564	._cache_dllArena.exe	34
PID 2312 wrote to memory of 2820	2312	Built.exe	35
PID 2312 wrote to memory of 2820	2312	Built.exe	35
PID 2312 wrote to memory of 2820	2312	Built.exe	35

C:\Users\Admin\AppData\Local\Temp\dllArena.exe
"C:\Users\Admin\AppData\Local\Temp\dllArena.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\._cache_dllArena.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_dllArena.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2820
- - C:\Users\Admin\AppData\Local\Temp\dllArena.exe
    "C:\Users\Admin\AppData\Local\Temp\dllArena.exe"
    3⤵
    - Executes dropped EXE
    PID:2384
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    PID:2444

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
8.4MB

MD5
b8849b60e1823b0cb7368b56a61c7743

SHA1
caa74767470173e44edc33dea3e604fe2620a720

SHA256
fd59a4887d5b72ae931bc2c8d3e95a0bd856fbf1c3922331ef00a98ff77dfb9e

SHA512
121a100f36184d885517153d94da3bf95a7fc96ea95d12f58addfd7847c9697ea80641316efcfda102ef49170aecb4075cc3dad24b213f3d326eabd13d09e6dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\AtAO3TF7.xlsm

Filesize
27KB

MD5
01ff779fc50f60ec2216e6329902a9e4

SHA1
47d3e38340e0d65a9c6aa9ce32502137d342c324

SHA256
e0dd1b94c58b1df68c44ba61a679a0226d4ee891c33c8ef6c61239896c9646d1

SHA512
b9c94e9af11021e5cf4d41208465a91a2af422c7b40ba44d16913f93a527060f3bbe2027eb7cc204f550a53947a567e0e4edf00fffd4e4dc2a68019b50c8ce4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\AtAO3TF7.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Built.exe

Filesize
7.0MB

MD5
94673f653706da9ebbd93580d287cc80

SHA1
9bfb2607d5da3d14b3b56c1aa2a7b65e1940dfa7

SHA256
8f41839c2a8a80984e95a7d8dd037f777aeebc72fc134ce4eb487b909f501603

SHA512
3a09df96d6434c53e925f9fc667ea896b49664c7e44e7b76a88460953b011450d3ebe3144296dac0f86412bbcdfbdc011178abf193c5f0b3524c1860b8a878ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23122\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\dllArena.exe

Filesize
1.1MB

MD5
3775d5ad506c1b476f96c244e6d1aae7

SHA1
873cd472995a6c1a7a229ce5be2c7576918a5a84

SHA256
c2e830c774b50e3b45725cf86f61753193f6ed6aa4accd316845a043a71c9103

SHA512
e1fa8f07645f34a29e968897a4fd09522e174ceb0fbb843a017ced18ecc45103981252cd78cf52d14baa25425eecea7667d37ec5876db0048cc54ec077cf2e27

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_dllArena.exe

Filesize
7.6MB

MD5
7c2457266d068fd709a59182de23d785

SHA1
531944996448063c946fd18340386cacf693884c

SHA256
5de0550f822ce7ec82356355c1665129164c1f491154bee035dbb8eae46e0ebc

SHA512
e93942be68995b21287772c762c3b959f04c503e277ddf74a96caa35a098abfdad5a5baf4bd82f90333db211998f9d803dd264eb0167bda6998c758117a131a6

Download Submit
memory/2444-36-0x0000000001350000-0x0000000001AFE000-memory.dmp

Filesize
7.7MB

Download
memory/2540-37-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2564-26-0x0000000000D20000-0x00000000014CE000-memory.dmp

Filesize
7.7MB

Download
memory/2640-117-0x0000000000400000-0x0000000000C64000-memory.dmp

Filesize
8.4MB

Download
memory/2640-175-0x0000000000400000-0x0000000000C64000-memory.dmp

Filesize
8.4MB

Download
memory/2820-116-0x000007FEF23B0000-0x000007FEF2998000-memory.dmp

Filesize
5.9MB

Download
memory/2820-120-0x000007FEF23B0000-0x000007FEF2998000-memory.dmp

Filesize
5.9MB

Download
memory/2984-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2984-25-0x0000000000400000-0x0000000000C64000-memory.dmp

Filesize
8.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads