xred | e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601

General

Target

e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe
Size

763KB
MD5

8b6cc1268113da1c722d64aaac6cd4d0
SHA1

24d876ff76af73561e489fc8a2d4cdc8170e9620
SHA256

e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601
SHA512

5f671699e3981bf2d7cf41e63741f6c5202cb9bb6e87582e4f891793c8052be62465ded38424f431d26ebe444851ed517b10b9eef83ed609d211bbaec29362bc
SSDEEP

12288:mMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9+1KE+VIB/:mnsJ39LyjbJkQFMhmC+6GD9OKE+VIF

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

Processes:

._cache_e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exeSynaptics.exe._cache_Synaptics.exe

pid	Process
2776	._cache_e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe
2852	Synaptics.exe
2548	._cache_Synaptics.exe

Loads dropped DLL 7 IoCs

Processes:

e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exeSynaptics.exe

pid	Process
2424	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe
2424	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe
2424	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe
2424	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe
2852	Synaptics.exe
2852	Synaptics.exe
2852	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exeSynaptics.exeEXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid	Process
2912	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EXCEL.EXE

pid	Process
2912	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exeSynaptics.exe

description	pid	Process	procid_target
PID 2424 wrote to memory of 2776	2424	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe	30
PID 2424 wrote to memory of 2776	2424	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe	30
PID 2424 wrote to memory of 2776	2424	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe	30
PID 2424 wrote to memory of 2776	2424	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe	30
PID 2424 wrote to memory of 2852	2424	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe	32
PID 2424 wrote to memory of 2852	2424	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe	32
PID 2424 wrote to memory of 2852	2424	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe	32
PID 2424 wrote to memory of 2852	2424	e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe	32
PID 2852 wrote to memory of 2548	2852	Synaptics.exe	33
PID 2852 wrote to memory of 2548	2852	Synaptics.exe	33
PID 2852 wrote to memory of 2548	2852	Synaptics.exe	33
PID 2852 wrote to memory of 2548	2852	Synaptics.exe	33

C:\Users\Admin\AppData\Local\Temp\e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe
"C:\Users\Admin\AppData\Local\Temp\e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\._cache_e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe"
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    PID:2548

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
763KB

MD5
8b6cc1268113da1c722d64aaac6cd4d0

SHA1
24d876ff76af73561e489fc8a2d4cdc8170e9620

SHA256
e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601

SHA512
5f671699e3981bf2d7cf41e63741f6c5202cb9bb6e87582e4f891793c8052be62465ded38424f431d26ebe444851ed517b10b9eef83ed609d211bbaec29362bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_e2e78ea20a6a4785a7723d8671d3e3fdb48d3b8de34f07b71becfd1ac1bed601N.exe

Filesize
10KB

MD5
f4ac24ba12d03fde6c392f5c8177f000

SHA1
303ec6325824c7c2b096893c751ce953955e65e1

SHA256
42937434f11c2ebc51f81b6accede45515f244d97c8cc25adae2f88537070608

SHA512
b276f79060703a645f2193bd7ab73ccc2196e6ecfc6c5f431d9b182b3ec30f07fb6aebf35368f4995dbd42f1c65070f6dada4245d80be79d958cb2eae2edbe04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pwd6Iis9.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pwd6Iis9.xlsm

Filesize
20KB

MD5
3e1e5d96fa73411edabba470b38243d0

SHA1
e32706d00b52d14d68212cd6c759b8a3bdab0bbc

SHA256
62cc59891382da48d75bae54882d8179a9c2e674c77f65bba4b4a9496383da20

SHA512
50d03127c424813f3a6294215c9e62a79f3115b9cc2a2e31b7199f34efd42be01fb53d7e87db7b3740617c9a0a205a87ab51383357a9a8023cf526d22b99d3ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pwd6Iis9.xlsm

Filesize
24KB

MD5
ad18712f5c16ef46a2200aa50be0bf8d

SHA1
1db3190f37c93b1e5f359149389a9b88379b3821

SHA256
9c4ad558a2925888b60a5861277f024cd5a4a44fa1f603756250f2201a620d62

SHA512
4e84a2845b1693b4c242817c7bc6196cf83fc0848f4ce353a06634f784daef2cee311b5f08e0f83ab167a9b266f7db8c2fed40349f3559173b6effc1dcf5a641

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pwd6Iis9.xlsm

Filesize
23KB

MD5
1df38c504916e3d9cafd3c7cf12dc195

SHA1
6fdabb620cd56f4be0add5dc9a8a2bce97f1f5c8

SHA256
56dbf46e499d8d2d01ad3caba2f44040dd110120a34a6607985f11ee98a0d612

SHA512
e01c6537446453187fe2145d2a34ab0e4c310bf6868f0c672012079b34401b0b3d39d9eaeff8529dd0637592cd96b8f6409630b4aec6be8472eaa6f2085f62f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pwd6Iis9.xlsm

Filesize
28KB

MD5
8cb8b66ac8b7c6b60680fc5d70bc25ef

SHA1
ac39fba332d269ea51576702614d0281d1711cea

SHA256
16b8fd43a1b74afa63ac13fa8a6d784f747eb8f00e0251fa6a8f9a5c01bf284f

SHA512
85d7aa0269a349af046839f4ab06f6c861bd0d6c7e7499df0bc1b081192d58c0796fe65b410c85631443a834eb554b6860a3f48d3adbe34b1118a38e240f1e4b

Download Submit
C:\Users\Admin\Documents\~$UsePush.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
memory/2424-27-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2424-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2852-117-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2852-152-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2912-41-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads