Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2024, 13:38

General

  • Target

    fef495e2d0a2f8a5c71e3f0e2a87a5580737b665500c8a18e0d0f16fc0a8181f.exe

  • Size

    753KB

  • MD5

    9311b94486fa68ba423b2fa14c54800a

  • SHA1

    b0ed9b0ecbd238b6839b4ae4a7b88211be78add9

  • SHA256

    fef495e2d0a2f8a5c71e3f0e2a87a5580737b665500c8a18e0d0f16fc0a8181f

  • SHA512

    43cb50b07242dfea00e780b409b54a4fa21cefade469b56776ff35cfc907907f6aa42a94c4c4a23a515c7cf67c4cbe51bb68718c0b6a3333415bfc16f843d698

  • SSDEEP

    12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9I7r:ansJ39LyjbJkQFMhmC+6GD9s

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fef495e2d0a2f8a5c71e3f0e2a87a5580737b665500c8a18e0d0f16fc0a8181f.exe
    "C:\Users\Admin\AppData\Local\Temp\fef495e2d0a2f8a5c71e3f0e2a87a5580737b665500c8a18e0d0f16fc0a8181f.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4160
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2248

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    753KB

    MD5

    9311b94486fa68ba423b2fa14c54800a

    SHA1

    b0ed9b0ecbd238b6839b4ae4a7b88211be78add9

    SHA256

    fef495e2d0a2f8a5c71e3f0e2a87a5580737b665500c8a18e0d0f16fc0a8181f

    SHA512

    43cb50b07242dfea00e780b409b54a4fa21cefade469b56776ff35cfc907907f6aa42a94c4c4a23a515c7cf67c4cbe51bb68718c0b6a3333415bfc16f843d698

  • C:\Users\Admin\AppData\Local\Temp\RJef8bYO.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\RJef8bYO.xlsm

    Filesize

    21KB

    MD5

    e62bb17a9becbdc6f9582badde1f0017

    SHA1

    e066bb2112b8da2bcaafc9005f949cf57219e8d2

    SHA256

    fb090c25966ce1e106a9eb007bf214d700429e1f73b3672445d6e93f683b579f

    SHA512

    e5f611ccb608c3d043c5485d0d31d03adae8071ac66e5853ba2a0d09abac441d696d44741efe2a1a8a1ad3354f9549ffc0070b6c8357dd3b263b7d260b47fa23

  • memory/2248-91-0x00007FFD5BBB0000-0x00007FFD5BBC0000-memory.dmp

    Filesize

    64KB

  • memory/2248-87-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-140-0x00007FFD9DC2D000-0x00007FFD9DC2E000-memory.dmp

    Filesize

    4KB

  • memory/2248-70-0x00007FFD5DC10000-0x00007FFD5DC20000-memory.dmp

    Filesize

    64KB

  • memory/2248-69-0x00007FFD9DC2D000-0x00007FFD9DC2E000-memory.dmp

    Filesize

    4KB

  • memory/2248-68-0x00007FFD5DC10000-0x00007FFD5DC20000-memory.dmp

    Filesize

    64KB

  • memory/2248-72-0x00007FFD5DC10000-0x00007FFD5DC20000-memory.dmp

    Filesize

    64KB

  • memory/2248-71-0x00007FFD5DC10000-0x00007FFD5DC20000-memory.dmp

    Filesize

    64KB

  • memory/2248-73-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-74-0x00007FFD5DC10000-0x00007FFD5DC20000-memory.dmp

    Filesize

    64KB

  • memory/2248-81-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-80-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-85-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-89-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-90-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-141-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-139-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-88-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-86-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-84-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-83-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-82-0x00007FFD5BBB0000-0x00007FFD5BBC0000-memory.dmp

    Filesize

    64KB

  • memory/2248-79-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-78-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-77-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-76-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-75-0x00007FFD9DB90000-0x00007FFD9DD85000-memory.dmp

    Filesize

    2.0MB

  • memory/4160-65-0x0000000000670000-0x0000000000671000-memory.dmp

    Filesize

    4KB

  • memory/4160-138-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4160-67-0x0000000000670000-0x0000000000671000-memory.dmp

    Filesize

    4KB

  • memory/4160-66-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4160-162-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4160-172-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4816-64-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/4816-0-0x0000000002250000-0x0000000002251000-memory.dmp

    Filesize

    4KB