xred | 75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b

General

Target

75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
Size

1.4MB
MD5

05a686c4d90be9eef89fba0582b5e505
SHA1

16d983a18e84a0e80c6d7cfd63318e57914eef91
SHA256

75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b
SHA512

00d173edb986b5162db56309c975bbaa91ec0b82feb45c717325995177105febd82bbdd796a78116ceb7462e92d7e3f5bc3f9032580fee7a1fdec5378d19b53f
SSDEEP

24576:HnsJ39LyjbJkQFMhmC+6GD9VQUhVUKXn/zjLyp65SNbRaYy5jJ3dW:HnsHyjtk2MYC5GDfQUoCo6YrEV34

Score

10^/10

xred backdoor discovery persistence upx

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred
Executes dropped EXE 3 IoCs

Processes:

._cache_75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exeSynaptics.exe._cache_Synaptics.exe

pid process

2416 ._cache_75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
2900 Synaptics.exe
2148 ._cache_Synaptics.exe

pid	process
2416	._cache_75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
2900	Synaptics.exe
2148	._cache_Synaptics.exe

Loads dropped DLL 7 IoCs

Processes:

75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exeSynaptics.exe

pid	process
2684	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
2684	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
2684	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
2684	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
2900	Synaptics.exe
2900	Synaptics.exe
2900	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\._cache_75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe	upx
behavioral1/memory/2416-22-0x0000000000400000-0x0000000000C72000-memory.dmp	upx
behavioral1/memory/2148-46-0x0000000000400000-0x0000000000C72000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exeSynaptics.exeEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1240 EXCEL.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EXCEL.EXE

pid process

1240 EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
1240	EXCEL.EXE

pid	process
1240	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exeSynaptics.exe

description	pid	process	target process
PID 2684 wrote to memory of 2416	2684	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe	._cache_75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
PID 2684 wrote to memory of 2416	2684	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe	._cache_75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
PID 2684 wrote to memory of 2416	2684	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe	._cache_75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
PID 2684 wrote to memory of 2416	2684	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe	._cache_75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
PID 2684 wrote to memory of 2900	2684	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe	Synaptics.exe
PID 2684 wrote to memory of 2900	2684	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe	Synaptics.exe
PID 2684 wrote to memory of 2900	2684	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe	Synaptics.exe
PID 2684 wrote to memory of 2900	2684	75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe	Synaptics.exe
PID 2900 wrote to memory of 2148	2900	Synaptics.exe	._cache_Synaptics.exe
PID 2900 wrote to memory of 2148	2900	Synaptics.exe	._cache_Synaptics.exe
PID 2900 wrote to memory of 2148	2900	Synaptics.exe	._cache_Synaptics.exe
PID 2900 wrote to memory of 2148	2900	Synaptics.exe	._cache_Synaptics.exe

C:\Users\Admin\AppData\Local\Temp\75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
"C:\Users\Admin\AppData\Local\Temp\75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Temp\._cache_75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe"
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    PID:2148

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.4MB

MD5
05a686c4d90be9eef89fba0582b5e505

SHA1
16d983a18e84a0e80c6d7cfd63318e57914eef91

SHA256
75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b

SHA512
00d173edb986b5162db56309c975bbaa91ec0b82feb45c717325995177105febd82bbdd796a78116ceb7462e92d7e3f5bc3f9032580fee7a1fdec5378d19b53f

Download Submit
C:\Users\Admin\AppData\Local\Temp\xNpJoQWp.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\xNpJoQWp.xlsm

Filesize
22KB

MD5
790d0494d9ee411abf7349f6bfba1c38

SHA1
f2a4d3ef25aa91d47aefa43ac405f4fb23c89a7f

SHA256
8672f28b5eeccac34a3f782a57201113fa5b5830e96d9f74c1ad8440b2ca4668

SHA512
ae021546c5b3927e3dfdba66e5145cbc41a69d2e8b92a33e204748614a766aa3f7678cdac97238bbcbdeb18f1f1b41c9c8c0bab4a594277d2338ab2616d3684e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xNpJoQWp.xlsm

Filesize
20KB

MD5
abdb830d2611b1ed800e711ec19f5253

SHA1
070ad4c8c7a0f3360752cfea467ca8197cd2144d

SHA256
f6b2673de308586f888871c333e612c46427a96a8ed9b8e58d5ce76817ed3eaf

SHA512
0aeee8c49e1a4b025312c2a18459dfb69cc83d2d5e1102d72b39596b34f72d4bcb9be19ecae2a70baa370afcdd1117181455fa6b3cbc386a8e99400eb95e563e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xNpJoQWp.xlsm

Filesize
25KB

MD5
ba39ba648549815c27e76988db08933e

SHA1
2911581fd474fd2b79dbd189fa6caf5f20ccf351

SHA256
c18f088f90fe332d91074c7d07b263c8ba51853bc94b00f463d25664db0dc08b

SHA512
151571d6fb3308ca3c0991288c16c82f57b4a6440a3e4b7a1508cecfd232fb4c5a2272106e05260ccc75b4a4e3f5fa40052a0c512ae2352be92186a458366571

Download Submit
C:\Users\Admin\AppData\Local\Temp\xNpJoQWp.xlsm

Filesize
26KB

MD5
1b4e84514a4d7b633643a377043536df

SHA1
dc6ffa39af19f4be997ec550dd8443372bd28cde

SHA256
e13b02a88921459235dde504717e5d58cc7c2b7fa09ceaa19a9b69738445456c

SHA512
a66726617374c2e05528367598d68bda31fe135a0c02797d23b07ae9af6ff3bd699ad46f25b6735702ce1d24bcf0c6582611390a9584ef4bdca7d3e7c0b1ff63

Download Submit
C:\Users\Admin\AppData\Local\Temp\~$xNpJoQWp.xlsm

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_75bb42224b7b2a9cdd6d6ddcedf1ee999606ed8ae472cee7182167280a3d9c5b.exe

Filesize
713KB

MD5
fee12c5e8b6dcd95682e359723b27d96

SHA1
ccbe8656b782a84ae1df00eb92e07b3952bb0eae

SHA256
43087f701b2e7fd6c3a9a00536df5b724c6b2f7cc122da0c44cd90a22d482903

SHA512
6851b7ed9aefbe3f2a05a0952e9c0caf231b4c3822c3e7526a05df63538a34541cf3801f91763dc6c3060fc33e523524a97ad250c13870f5f8ff6d88ff71bce4

Download Submit
memory/1240-47-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1240-123-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2148-46-0x0000000000400000-0x0000000000C72000-memory.dmp

Filesize
8.4MB

Download
memory/2416-22-0x0000000000400000-0x0000000000C72000-memory.dmp

Filesize
8.4MB

Download
memory/2684-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2684-31-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2684-19-0x0000000005530000-0x0000000005DA2000-memory.dmp

Filesize
8.4MB

Download
memory/2684-20-0x0000000005530000-0x0000000005DA2000-memory.dmp

Filesize
8.4MB

Download
memory/2900-44-0x0000000005860000-0x00000000060D2000-memory.dmp

Filesize
8.4MB

Download
memory/2900-45-0x0000000005860000-0x00000000060D2000-memory.dmp

Filesize
8.4MB

Download
memory/2900-125-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2900-127-0x0000000005860000-0x00000000060D2000-memory.dmp

Filesize
8.4MB

Download
memory/2900-130-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/2900-164-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads