Analysis

  • max time kernel
    113s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 19:11

General

  • Target

    e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe

  • Size

    2.5MB

  • MD5

    048bc26f865c89de0e2925b5085ac680

  • SHA1

    b36c32e65fdbfcd03e044a61fa58a556b918c069

  • SHA256

    e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5e

  • SHA512

    dd3b1154dbef4a2c286f04be86f61b6f7192adc10f8b18d3280fdbb82f5fda21130b8e1e998784f588815fd1a4a437ef3bbebad55d532c6eaeb9c083ea561bde

  • SSDEEP

    49152:unsHyjtk2MYC5GDmSoZr3GzErU7fST52n6zRf9J:unsmtk2a1jazh7fDmRfD

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe
    "C:\Users\Admin\AppData\Local\Temp\e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:384
    • C:\Users\Admin\AppData\Local\Temp\._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4036
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1456
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5048
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4148

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    2.5MB

    MD5

    048bc26f865c89de0e2925b5085ac680

    SHA1

    b36c32e65fdbfcd03e044a61fa58a556b918c069

    SHA256

    e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5e

    SHA512

    dd3b1154dbef4a2c286f04be86f61b6f7192adc10f8b18d3280fdbb82f5fda21130b8e1e998784f588815fd1a4a437ef3bbebad55d532c6eaeb9c083ea561bde

  • C:\Users\Admin\AppData\Local\Temp\._cache_e7c3247a0f63982836ba5522c087070282ab57808176bf7d7da12256d5b62a5eN.exe

    Filesize

    1.8MB

    MD5

    2408f3678daae195ce1790d4ce72f212

    SHA1

    a0ebf04b3259f50aca5d076445b3b6a57935a1a9

    SHA256

    a921395be8d70d9356080d19eeca3348e6c01be695d90c254cedbe2a1a75a270

    SHA512

    c100a8701944fa701172a984737013214b9cefe080e916fb895d1ba27d02debbe84529736e348b4782428a6e1e49a57b4df1c62c0f7015e822a08a85c5e0c53f

  • C:\Users\Admin\AppData\Local\Temp\2Pf9L85P.xlsm

    Filesize

    17KB

    MD5

    af4d37aad8b34471da588360a43e768a

    SHA1

    83ed64667d4e68ea531b8bcf58aab3ed4a5ca998

    SHA256

    e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1

    SHA512

    74f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da

  • C:\Users\Admin\AppData\Local\Temp\apm7EE4.tmp

    Filesize

    148KB

    MD5

    10a2f663fdc511fd52bfcfd0a8837549

    SHA1

    e3669af6eeb82c20b10245caa4974cb727b52bf0

    SHA256

    bd5f2e4ac7c2bea616fa60a50698b0d6d46a9456c08392a5c62c340d6f738eeb

    SHA512

    7e54bcce8f6813873db102f010431ad1ba83d554e9c368c598d428a1b8e6bc10f3622e559c0daa9d5b1740aa6fc08a5d97bc3f23217035b929a64b0399ce9830

  • memory/384-0-0x0000000002410000-0x0000000002411000-memory.dmp

    Filesize

    4KB

  • memory/384-107-0x0000000000400000-0x0000000000689000-memory.dmp

    Filesize

    2.5MB

  • memory/1456-247-0x0000000000400000-0x0000000000689000-memory.dmp

    Filesize

    2.5MB

  • memory/1456-192-0x0000000000400000-0x0000000000689000-memory.dmp

    Filesize

    2.5MB

  • memory/4036-94-0x00000000024C0000-0x00000000024C1000-memory.dmp

    Filesize

    4KB

  • memory/4036-189-0x00000000024C0000-0x00000000024C1000-memory.dmp

    Filesize

    4KB

  • memory/4036-190-0x0000000000400000-0x000000000060A000-memory.dmp

    Filesize

    2.0MB

  • memory/4036-99-0x0000000010000000-0x0000000010081000-memory.dmp

    Filesize

    516KB

  • memory/4148-173-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

    Filesize

    64KB

  • memory/4148-176-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

    Filesize

    64KB

  • memory/4148-177-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

    Filesize

    64KB

  • memory/4148-178-0x00007FFCEFE70000-0x00007FFCEFE80000-memory.dmp

    Filesize

    64KB

  • memory/4148-179-0x00007FFCEFE70000-0x00007FFCEFE80000-memory.dmp

    Filesize

    64KB

  • memory/4148-174-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

    Filesize

    64KB

  • memory/4148-175-0x00007FFCF27D0000-0x00007FFCF27E0000-memory.dmp

    Filesize

    64KB

  • memory/5048-172-0x0000000010000000-0x0000000010081000-memory.dmp

    Filesize

    516KB

  • memory/5048-193-0x0000000000400000-0x000000000060A000-memory.dmp

    Filesize

    2.0MB