xred | 70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358

Analysis

max time kernel
111s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2024, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe
Size 783KB
Sample241124-efh7laspew
SHA256 70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358
MD5 f2b6b9f9c651374bf6a84b3ab4c4b010
SHA1 867d9c40e2fa18a865e7d1841db29f757bb7cf02
SHA512 8362ae3d694b5ade1d47afdb04515128b5c34128bf0c916be4d6df4cb91c318d1cd14e5e997fd8b459705e0e0ae0c88e686a18bc2125d5c471d7aafbc7473075
SSDEEP 12288:sMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9L4/j:snsJ39LyjbJkQFMhmC+6GD90
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 3 IoCs

pid	Process
1772	._cache_70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe
4860	Synaptics.exe
4292	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4768	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4768	EXCEL.EXE
4768	EXCEL.EXE
4768	EXCEL.EXE
4768	EXCEL.EXE
4768	EXCEL.EXE
4768	EXCEL.EXE
4768	EXCEL.EXE
4768	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 1772	3472	70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe	83
PID 3472 wrote to memory of 1772	3472	70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe	83
PID 3472 wrote to memory of 1772	3472	70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe	83
PID 3472 wrote to memory of 4860	3472	70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe	84
PID 3472 wrote to memory of 4860	3472	70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe	84
PID 3472 wrote to memory of 4860	3472	70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe	84
PID 4860 wrote to memory of 4292	4860	Synaptics.exe	85
PID 4860 wrote to memory of 4292	4860	Synaptics.exe	85
PID 4860 wrote to memory of 4292	4860	Synaptics.exe	85

C:\Users\Admin\AppData\Local\Temp\70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe
"C:\Users\Admin\AppData\Local\Temp\70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\._cache_70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1772
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4292

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 783KB
SHA256 70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358
MD5 f2b6b9f9c651374bf6a84b3ab4c4b010
SHA1 867d9c40e2fa18a865e7d1841db29f757bb7cf02
SHA512 8362ae3d694b5ade1d47afdb04515128b5c34128bf0c916be4d6df4cb91c318d1cd14e5e997fd8b459705e0e0ae0c88e686a18bc2125d5c471d7aafbc7473075
SSDEEP 12288:sMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9L4/j:snsJ39LyjbJkQFMhmC+6GD90
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_70a7f2a1ca8f35b2fa8dff1a6bf569b7031015da1ea537d363308609d8d89358N.exe
Size 30KB
SHA256 ee82795ada1496176af0e99abd4c38a5e27c243ebc8c29f233fdde8450b997a7
MD5 7768c9f29a2d93ebced1d24d4df51650
SHA1 abd491a664dd13a66ac19039683a8a60848c3ea6
SHA512 91de6823fa7665dc89ce246105790c8ce0822ff682ba80eb14a89c6689db70c73fea838066feb7983b7673ac4275728f3c85bd1f4d1c3bd0935b96dbf878f511
SSDEEP 384:Hdb+1fNO/MYjbKaJC8chsK26H7/7o6gpDC6FJXlSA+POTSg/WrcLBWzeEV+9m:P+EqSKd/7MQ6FJXaOOgTLT99m
MD5 SHA1 SHA512 SSDEEP

Submit Download

AB975E00

Path C:\Users\Admin\AppData\Local\Temp\AB975E00
Size 23KB
SHA256 656fcdccb35ca5862842b92cd494495d7a6df9ad8a59f682a8d639e581e9926d
MD5 15fafb9e519738c02eb96bd697791191
SHA1 7cae23ff63410e96ccd77cca45bc05163477b323
SHA512 5f73a103b377dd7c24e8b6fd0bcc1c4136e26fef284ed1e1333314a94d8f71bbb324350384b4b86b76dd23ab267d34a18137a7525f02a2bb56488a9da5156a2e
SSDEEP 384:MuCvWwhfvKWp+o5bnrdGLUn4nvwweJlrDNHqrQCTXHVbW85a6O0tGSGup/:MuCeAvP4o5brdL4nYwe/rupRyKRYSR
MD5 SHA1 SHA512 SSDEEP

Submit Download

xGs2JYuM.xlsm

Path C:\Users\Admin\AppData\Local\Temp\xGs2JYuM.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3472-0-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/3472-128-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/4768-193-0x00007FFC38CF0000-0x00007FFC38D00000-memory.dmp

Download

memory/4768-192-0x00007FFC38CF0000-0x00007FFC38D00000-memory.dmp

Download

memory/4768-191-0x00007FFC38CF0000-0x00007FFC38D00000-memory.dmp

Download

memory/4768-194-0x00007FFC38CF0000-0x00007FFC38D00000-memory.dmp

Download

memory/4768-195-0x00007FFC369B0000-0x00007FFC369C0000-memory.dmp

Download

memory/4768-196-0x00007FFC369B0000-0x00007FFC369C0000-memory.dmp

Download

memory/4768-190-0x00007FFC38CF0000-0x00007FFC38D00000-memory.dmp

Download

memory/4860-129-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download

memory/4860-243-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/4860-244-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download

memory/4860-275-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads