Extracted

• • Target

    dllArena.exe

  • Size

    8.4MB

  • MD5

    b8849b60e1823b0cb7368b56a61c7743

  • SHA1

    caa74767470173e44edc33dea3e604fe2620a720

  • SHA256

    fd59a4887d5b72ae931bc2c8d3e95a0bd856fbf1c3922331ef00a98ff77dfb9e

  • SHA512

    121a100f36184d885517153d94da3bf95a7fc96ea95d12f58addfd7847c9697ea80641316efcfda102ef49170aecb4075cc3dad24b213f3d326eabd13d09e6dd

  • SSDEEP

    196608:2LvgQdj4O9LgRRHG94UEbrURbsvnEJlQ9BWg:2LdX2RRmqUEbwRbsvnIG9BWg

  Score

  10^/10

  xredbackdoordiscoverymacropersistenceupxcollectioncredential_accessdefense_evasionexecutionspywarestealer

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2