Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 21:28

General

  • Target

    3b4b87fdc8c5531b416d5d9817c8ea165c8a79ad4d23154a50cd55a4965a585d.exe

  • Size

    1.2MB

  • MD5

    0de4333f75d28ab023f56e208ea1f4f2

  • SHA1

    7edd7e6ce18728cbe132c256bbdc51a7b24002d5

  • SHA256

    3b4b87fdc8c5531b416d5d9817c8ea165c8a79ad4d23154a50cd55a4965a585d

  • SHA512

    d8c0cf967227837f9d49dd271e99c408d63909cc954074dc21f1fb788bb5bf1bccd9e5a1b7c997b2373b35ff0897fe43bcd3221e38a708642a14493a6271e54e

  • SSDEEP

    24576:oGl/8l+k1W0tq78x3s+hPNt790/ASMcmqhrbjXxI+PpKWSJTzCduD:Ll/8l+kAf78x3B2ASMHKrfPpATz3D

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b4b87fdc8c5531b416d5d9817c8ea165c8a79ad4d23154a50cd55a4965a585d.exe
    "C:\Users\Admin\AppData\Local\Temp\3b4b87fdc8c5531b416d5d9817c8ea165c8a79ad4d23154a50cd55a4965a585d.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4512
    • C:\Users\Admin\AppData\Local\Temp\tmp142.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp142.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5004
      • C:\Users\Admin\AppData\Local\Temp\tmp142.exe
        C:\Users\Admin\AppData\Local\Temp\tmp142.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\Users\Admin\AppData\Local\Temp\._cache_tmp142.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_tmp142.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2132
          • C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe
            "C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            PID:1108
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4432
          • C:\ProgramData\Synaptics\Synaptics.exe
            C:\ProgramData\Synaptics\Synaptics.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1432
            • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
              "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              PID:852
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3B4B87~1.EXE >> NUL
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2388
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5024
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2460
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2240

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\._cache_tmp142.exe

    Filesize

    318KB

    MD5

    166cf19911e45785a3407433a2b447c4

    SHA1

    a08d582e55c5b66ef78bd5dd3e386730d8be4227

    SHA256

    a7b85bf490f372521788658ec25d3de4a14babd79abb5ddb646e30d87dd9ae27

    SHA512

    7934c5bf3657a4396fca70daebe01cd11e61c8e3f9b5cfd9c068d688f8b91ab5058c5dc68b0ba80b32b276348afb8ea6e70bba5f314722a7f04011607a3e7b14

  • C:\Users\Admin\AppData\Local\Temp\AFB75E00

    Filesize

    24KB

    MD5

    70fcc4d41f809617dafc84f05286420f

    SHA1

    f57d6f0e3a5b604ac110bc159bbe13acdf95dff8

    SHA256

    b39b42af320073d3c2327f58daff1ef762ce0c6401c6d020933bd5a0689e6150

    SHA512

    f30e40b0bd423a915299ef998e8cf0a3316cc49e0732fb5c065607d41623c1d91807db8fb1157be083998fc86344bde93c8bb1c2d86073d7e196a88db780be2a

  • C:\Users\Admin\AppData\Local\Temp\IPeAQ5vg.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\melt.txt

    Filesize

    52B

    MD5

    29d493876bc0b2c8a6f38aa4a4379166

    SHA1

    dbb33f3fc329e87dbf2dd292c61207570706fa41

    SHA256

    984c05a8529073f415e789b0af9355d0c1f2e232993eed1b967403e42b34233e

    SHA512

    45f6921600962d05a6cb03280194324a277d5a81fb1b7ff64679be38ad1b190fca2b531e08a834500861ac08283f063512c3e9d03274748d060d77bb083a006b

  • C:\Users\Admin\AppData\Local\Temp\melt.txt

    Filesize

    55B

    MD5

    6b1120fc600709ac2a9bca24748ef527

    SHA1

    30edf806f6ca0fc848646e16736ffd4023e33d29

    SHA256

    05efbecfb9f31be92e98e62caac469f974f49cbaeea800d5a6a42eba4f706ba6

    SHA512

    861c6929c438e7985abb8ad3a9ce8dad1f1abc84ebf682ed4676ba5020e500ce63f94f88263c016308a4cbae95e7133c2617b253a05ed3e88967a512233d3982

  • C:\Users\Admin\AppData\Local\Temp\tmp142.exe

    Filesize

    1.2MB

    MD5

    0de4333f75d28ab023f56e208ea1f4f2

    SHA1

    7edd7e6ce18728cbe132c256bbdc51a7b24002d5

    SHA256

    3b4b87fdc8c5531b416d5d9817c8ea165c8a79ad4d23154a50cd55a4965a585d

    SHA512

    d8c0cf967227837f9d49dd271e99c408d63909cc954074dc21f1fb788bb5bf1bccd9e5a1b7c997b2373b35ff0897fe43bcd3221e38a708642a14493a6271e54e

  • memory/1432-314-0x0000000000400000-0x0000000000510000-memory.dmp

    Filesize

    1.1MB

  • memory/1432-286-0x0000000000400000-0x0000000000510000-memory.dmp

    Filesize

    1.1MB

  • memory/1432-267-0x0000000000400000-0x0000000000510000-memory.dmp

    Filesize

    1.1MB

  • memory/1432-268-0x0000000000400000-0x0000000000510000-memory.dmp

    Filesize

    1.1MB

  • memory/1432-146-0x0000000000400000-0x0000000000510000-memory.dmp

    Filesize

    1.1MB

  • memory/2132-112-0x000000001B590000-0x000000001B636000-memory.dmp

    Filesize

    664KB

  • memory/2132-116-0x000000001C220000-0x000000001C26C000-memory.dmp

    Filesize

    304KB

  • memory/2132-117-0x000000001E510000-0x000000001E81E000-memory.dmp

    Filesize

    3.1MB

  • memory/2132-115-0x0000000000EF0000-0x0000000000EF8000-memory.dmp

    Filesize

    32KB

  • memory/2132-114-0x000000001C080000-0x000000001C11C000-memory.dmp

    Filesize

    624KB

  • memory/2132-113-0x000000001BB10000-0x000000001BFDE000-memory.dmp

    Filesize

    4.8MB

  • memory/2460-213-0x00007FFD0AEA0000-0x00007FFD0AEB0000-memory.dmp

    Filesize

    64KB

  • memory/2460-284-0x00007FFD0D5F0000-0x00007FFD0D600000-memory.dmp

    Filesize

    64KB

  • memory/2460-207-0x00007FFD0D5F0000-0x00007FFD0D600000-memory.dmp

    Filesize

    64KB

  • memory/2460-211-0x00007FFD0D5F0000-0x00007FFD0D600000-memory.dmp

    Filesize

    64KB

  • memory/2460-212-0x00007FFD0AEA0000-0x00007FFD0AEB0000-memory.dmp

    Filesize

    64KB

  • memory/2460-210-0x00007FFD0D5F0000-0x00007FFD0D600000-memory.dmp

    Filesize

    64KB

  • memory/2460-208-0x00007FFD0D5F0000-0x00007FFD0D600000-memory.dmp

    Filesize

    64KB

  • memory/2460-283-0x00007FFD0D5F0000-0x00007FFD0D600000-memory.dmp

    Filesize

    64KB

  • memory/2460-209-0x00007FFD0D5F0000-0x00007FFD0D600000-memory.dmp

    Filesize

    64KB

  • memory/2460-285-0x00007FFD0D5F0000-0x00007FFD0D600000-memory.dmp

    Filesize

    64KB

  • memory/2460-282-0x00007FFD0D5F0000-0x00007FFD0D600000-memory.dmp

    Filesize

    64KB

  • memory/4992-12-0x0000000000400000-0x0000000000510000-memory.dmp

    Filesize

    1.1MB

  • memory/4992-13-0x0000000002280000-0x0000000002281000-memory.dmp

    Filesize

    4KB

  • memory/4992-8-0x0000000000400000-0x0000000000510000-memory.dmp

    Filesize

    1.1MB

  • memory/4992-109-0x0000000000400000-0x0000000000510000-memory.dmp

    Filesize

    1.1MB

  • memory/4992-9-0x0000000000400000-0x0000000000510000-memory.dmp

    Filesize

    1.1MB

  • memory/4992-11-0x0000000000400000-0x0000000000510000-memory.dmp

    Filesize

    1.1MB