xred | fd59a4887d5b72ae931bc2c8d3e95a0bd856fbf1c3922331ef00a98ff77dfb9e

General

Target

dllArena.exe
Size

8.4MB
MD5

b8849b60e1823b0cb7368b56a61c7743
SHA1

caa74767470173e44edc33dea3e604fe2620a720
SHA256

fd59a4887d5b72ae931bc2c8d3e95a0bd856fbf1c3922331ef00a98ff77dfb9e
SHA512

121a100f36184d885517153d94da3bf95a7fc96ea95d12f58addfd7847c9697ea80641316efcfda102ef49170aecb4075cc3dad24b213f3d326eabd13d09e6dd
SSDEEP

196608:2LvgQdj4O9LgRRHG94UEbrURbsvnEJlQ9BWg:2LdX2RRmqUEbwRbsvnIG9BWg

Score

10^/10

xred backdoor discovery macro persistence upx

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x000600000001879b-85.dat

Executes dropped EXE 7 IoCs

pid	Process
2808	._cache_dllArena.exe
2536	Synaptics.exe
2472	._cache_Synaptics.exe
1556	Built.exe
1420	Built.exe
2336	dllArena.exe
1160	Process not Found

Loads dropped DLL 10 IoCs

pid	Process
2856	dllArena.exe
2856	dllArena.exe
2856	dllArena.exe
2536	Synaptics.exe
2536	Synaptics.exe
2808	._cache_dllArena.exe
1556	Built.exe
1420	Built.exe
2808	._cache_dllArena.exe
1160	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	dllArena.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000193d9-120.dat	upx
behavioral1/memory/1420-122-0x000007FEF2EB0000-0x000007FEF3498000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllArena.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1404	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1404	EXCEL.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2808	2856	dllArena.exe	30
PID 2856 wrote to memory of 2808	2856	dllArena.exe	30
PID 2856 wrote to memory of 2808	2856	dllArena.exe	30
PID 2856 wrote to memory of 2808	2856	dllArena.exe	30
PID 2856 wrote to memory of 2536	2856	dllArena.exe	31
PID 2856 wrote to memory of 2536	2856	dllArena.exe	31
PID 2856 wrote to memory of 2536	2856	dllArena.exe	31
PID 2856 wrote to memory of 2536	2856	dllArena.exe	31
PID 2536 wrote to memory of 2472	2536	Synaptics.exe	32
PID 2536 wrote to memory of 2472	2536	Synaptics.exe	32
PID 2536 wrote to memory of 2472	2536	Synaptics.exe	32
PID 2536 wrote to memory of 2472	2536	Synaptics.exe	32
PID 2808 wrote to memory of 1556	2808	._cache_dllArena.exe	34
PID 2808 wrote to memory of 1556	2808	._cache_dllArena.exe	34
PID 2808 wrote to memory of 1556	2808	._cache_dllArena.exe	34
PID 1556 wrote to memory of 1420	1556	Built.exe	35
PID 1556 wrote to memory of 1420	1556	Built.exe	35
PID 1556 wrote to memory of 1420	1556	Built.exe	35
PID 2808 wrote to memory of 2336	2808	._cache_dllArena.exe	36
PID 2808 wrote to memory of 2336	2808	._cache_dllArena.exe	36
PID 2808 wrote to memory of 2336	2808	._cache_dllArena.exe	36

C:\Users\Admin\AppData\Local\Temp\dllArena.exe
"C:\Users\Admin\AppData\Local\Temp\dllArena.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\._cache_dllArena.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_dllArena.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1420
- - C:\Users\Admin\AppData\Local\Temp\dllArena.exe
    "C:\Users\Admin\AppData\Local\Temp\dllArena.exe"
    3⤵
    - Executes dropped EXE
    PID:2336
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    PID:2472

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
8.4MB

MD5
b8849b60e1823b0cb7368b56a61c7743

SHA1
caa74767470173e44edc33dea3e604fe2620a720

SHA256
fd59a4887d5b72ae931bc2c8d3e95a0bd856fbf1c3922331ef00a98ff77dfb9e

SHA512
121a100f36184d885517153d94da3bf95a7fc96ea95d12f58addfd7847c9697ea80641316efcfda102ef49170aecb4075cc3dad24b213f3d326eabd13d09e6dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15562\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4pYXfjD.xlsm

Filesize
28KB

MD5
a0145ecae020e072a33c99b671992213

SHA1
7a154a846e3e47b70b64fd9937d7e7dbf3923b1b

SHA256
67de1a7ae9fdfd10f9fe86fc202c0360952cd922da22f32f558ff56d2f251612

SHA512
424538d8a5215b94ac539eaadf78ad8851efd5b12708228637fdc03cc0bec79129a2b967710894fc55c871db7aab42362909ada512dbc22d3a68005dbd57e9e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4pYXfjD.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4pYXfjD.xlsm

Filesize
22KB

MD5
3eb47f3c10aaa5470e64f4fd4aa51bda

SHA1
d724bdc0a6c94063368f2594768ae0b36c51b1f2

SHA256
4acfb9c824e7af82446e8a78bbfe382dbcca486d75d864e23cdaf7063419effc

SHA512
60edaba281fff85f6f4b5dacbbece82508dae5d777b9f5813109e2151ff159773539de505475ef16fc36cded884b9bbdca90f8989a41b77e418eb34dcfb37d0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\dllArena.exe

Filesize
1.1MB

MD5
3775d5ad506c1b476f96c244e6d1aae7

SHA1
873cd472995a6c1a7a229ce5be2c7576918a5a84

SHA256
c2e830c774b50e3b45725cf86f61753193f6ed6aa4accd316845a043a71c9103

SHA512
e1fa8f07645f34a29e968897a4fd09522e174ceb0fbb843a017ced18ecc45103981252cd78cf52d14baa25425eecea7667d37ec5876db0048cc54ec077cf2e27

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_dllArena.exe

Filesize
7.6MB

MD5
7c2457266d068fd709a59182de23d785

SHA1
531944996448063c946fd18340386cacf693884c

SHA256
5de0550f822ce7ec82356355c1665129164c1f491154bee035dbb8eae46e0ebc

SHA512
e93942be68995b21287772c762c3b959f04c503e277ddf74a96caa35a098abfdad5a5baf4bd82f90333db211998f9d803dd264eb0167bda6998c758117a131a6

Download Submit
\Users\Admin\AppData\Local\Temp\Built.exe

Filesize
7.0MB

MD5
94673f653706da9ebbd93580d287cc80

SHA1
9bfb2607d5da3d14b3b56c1aa2a7b65e1940dfa7

SHA256
8f41839c2a8a80984e95a7d8dd037f777aeebc72fc134ce4eb487b909f501603

SHA512
3a09df96d6434c53e925f9fc667ea896b49664c7e44e7b76a88460953b011450d3ebe3144296dac0f86412bbcdfbdc011178abf193c5f0b3524c1860b8a878ae

Download Submit
memory/1404-36-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1420-122-0x000007FEF2EB0000-0x000007FEF3498000-memory.dmp

Filesize
5.9MB

Download
memory/2472-37-0x0000000000A10000-0x00000000011BE000-memory.dmp

Filesize
7.7MB

Download
memory/2536-130-0x0000000000400000-0x0000000000C64000-memory.dmp

Filesize
8.4MB

Download
memory/2536-151-0x0000000000400000-0x0000000000C64000-memory.dmp

Filesize
8.4MB

Download
memory/2536-185-0x0000000000400000-0x0000000000C64000-memory.dmp

Filesize
8.4MB

Download
memory/2808-28-0x0000000001210000-0x00000000019BE000-memory.dmp

Filesize
7.7MB

Download
memory/2856-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2856-25-0x0000000000400000-0x0000000000C64000-memory.dmp

Filesize
8.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads