Analysis

  • max time kernel
    112s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 15:05

General

  • Target

    f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe

  • Size

    1.7MB

  • MD5

    59fdd620fc7cd0cdb4ea8347c8a64980

  • SHA1

    15cd837855597e4b96531a041e412e6d417ee07a

  • SHA256

    f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890

  • SHA512

    780195acc367e86c774bc4be7d5bce81b0990ac081ee7507e9d66dbdc773b01a8d4cf78ac7f0119333f755bb1b21df0096a11f9206f8d01409f73de24d626e6c

  • SSDEEP

    49152:LnsHyjtk2MYC5GDXY80D4YSbxIWvbqmmdtL4i96UM:Lnsmtk2auYRmbSIKSi9Q

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe
    "C:\Users\Admin\AppData\Local\Temp\f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\Users\Admin\AppData\Local\Temp\._cache_f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3248
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1980
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    1.7MB

    MD5

    59fdd620fc7cd0cdb4ea8347c8a64980

    SHA1

    15cd837855597e4b96531a041e412e6d417ee07a

    SHA256

    f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890

    SHA512

    780195acc367e86c774bc4be7d5bce81b0990ac081ee7507e9d66dbdc773b01a8d4cf78ac7f0119333f755bb1b21df0096a11f9206f8d01409f73de24d626e6c

  • C:\Users\Admin\AppData\Local\Temp\._cache_f227884cd69a338634b62d15306a2722c4e09e441bd6be2ace6f1b8025b91890N.exe

    Filesize

    979KB

    MD5

    8ce50fc290bed7711d97b16d5ffb49f6

    SHA1

    59cdc83c4d5f32ca1d5bdc32fe6656fadb27a72f

    SHA256

    023b628b690f5185604fc7218dc4e9842604c7bd9f2e2c065f9360255cb39e49

    SHA512

    455905bf556e9629c4ad1eea48ab1c4aa471462f289a74fbe6a06071a58e8cad2a31b686bd39e62e2e15be9bab2e64ea6c52d829738519eb159ca59609fc1ef9

  • C:\Users\Admin\AppData\Local\Temp\3FA75E00

    Filesize

    23KB

    MD5

    190e459a0d27c24dc19703512b338092

    SHA1

    6b4ff5077a8ac6edc959c455a5563bc2106cd1ac

    SHA256

    894a477000546848fc6b3d10ba9cf8daa9bbf4c50856448f9d570aef2e4b5154

    SHA512

    b189de961f400970c4958a549ef8f8f64eb9b9c488ea3888e3f4643654b82a6afbf9b122075b1550ee1e08b6cf62c9a7bed3501d9b96c565f0eb25ea43311a4a

  • C:\Users\Admin\AppData\Local\Temp\SJK9N17g.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • memory/1980-193-0x0000000000400000-0x0000000001A73000-memory.dmp

    Filesize

    22.4MB

  • memory/1980-254-0x0000000000400000-0x0000000001A73000-memory.dmp

    Filesize

    22.4MB

  • memory/1980-194-0x0000000000400000-0x0000000001A73000-memory.dmp

    Filesize

    22.4MB

  • memory/2400-286-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/2400-267-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/2400-253-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/2564-201-0x00007FF9B77F0000-0x00007FF9B7800000-memory.dmp

    Filesize

    64KB

  • memory/2564-197-0x00007FF9B9930000-0x00007FF9B9940000-memory.dmp

    Filesize

    64KB

  • memory/2564-196-0x00007FF9B9930000-0x00007FF9B9940000-memory.dmp

    Filesize

    64KB

  • memory/2564-195-0x00007FF9B9930000-0x00007FF9B9940000-memory.dmp

    Filesize

    64KB

  • memory/2564-200-0x00007FF9B77F0000-0x00007FF9B7800000-memory.dmp

    Filesize

    64KB

  • memory/2564-198-0x00007FF9B9930000-0x00007FF9B9940000-memory.dmp

    Filesize

    64KB

  • memory/2564-199-0x00007FF9B9930000-0x00007FF9B9940000-memory.dmp

    Filesize

    64KB

  • memory/3248-134-0x0000000000400000-0x0000000001A73000-memory.dmp

    Filesize

    22.4MB

  • memory/3248-127-0x0000000000400000-0x0000000001A73000-memory.dmp

    Filesize

    22.4MB

  • memory/3248-130-0x0000000005B50000-0x0000000005B51000-memory.dmp

    Filesize

    4KB

  • memory/4800-0-0x0000000002460000-0x0000000002461000-memory.dmp

    Filesize

    4KB

  • memory/4800-128-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB