Extracted

• • Target

    6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82.exe

  • Size

    6.1MB

  • MD5

    02bec9d86e4839199a60b334dd650e60

  • SHA1

    8f86b49725abfae4c201654f3aa43ec0041cea39

  • SHA256

    6346a63f22a66cd7bea354850db4603944fc7a846c304034b4d359696380ab82

  • SHA512

    660d932f4b2fe56d175ba3c2823a0501d13e29876766a57bd4df5b345177887b48fb9eedcf0c3929cca509f49a2bb189395e82c2418fa6e8834e0a2f79425243

  • SSDEEP

    196608:iLmGZT4llVN1apVkFGT5KSPNOe7mBuyQzh:iyST4TlIGWK+N0BnQzh

  Score

  10^/10

  xredbackdoordefense_evasiondiscoveryevasionpersistenceprivilege_escalationupx

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Disables RegEdit via registry modification

    evasion

  • Drops file in Drivers directory

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Indicator Removal: Clear Persistence

    remove IFEO.

    defense_evasion

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2