xred | 7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246

Analysis

max time kernel
112s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2024, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe
Size 917KB
Sample241125-b89cpsxmgn
SHA256 7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246
MD5 6a494fc8075128e4cdc44df078371830
SHA1 40640cea034b31b470d960df6e09b165d143562f
SHA512 50e8730b47b9108fba93745acc7c34ce14dd8c2d82af46a9f0348f44ed57389a9c383006d751b71fda8f99a75bd393e7c0e07be536c7bf973ca4921c2dd6c5f6
SSDEEP 12288:wMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9nr3I5sUesDns6BAeRv:wnsJ39LyjbJkQFMhmC+6GD9r3+sXqnrF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Deletes itself 1 IoCs

pid	Process
4604	Au_.exe

Executes dropped EXE 5 IoCs

pid	Process
3404	._cache_7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe
4604	Au_.exe
2100	Synaptics.exe
2168	._cache_Synaptics.exe
2736	Bu_.exe

Loads dropped DLL 14 IoCs

pid	Process
4604	Au_.exe
4604	Au_.exe
2736	Bu_.exe
2736	Bu_.exe
4604	Au_.exe
4604	Au_.exe
4604	Au_.exe
2736	Bu_.exe
4604	Au_.exe
4604	Au_.exe
2736	Bu_.exe
2736	Bu_.exe
2736	Bu_.exe
2736	Bu_.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bu_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x000c000000023b0e-5.dat	nsis_installer_1

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4108	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4108	EXCEL.EXE
4108	EXCEL.EXE
4108	EXCEL.EXE
4108	EXCEL.EXE
4108	EXCEL.EXE
4108	EXCEL.EXE
4108	EXCEL.EXE
4108	EXCEL.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 3404	2888	7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe	82
PID 2888 wrote to memory of 3404	2888	7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe	82
PID 2888 wrote to memory of 3404	2888	7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe	82
PID 3404 wrote to memory of 4604	3404	._cache_7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe	83
PID 3404 wrote to memory of 4604	3404	._cache_7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe	83
PID 3404 wrote to memory of 4604	3404	._cache_7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe	83
PID 2888 wrote to memory of 2100	2888	7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe	84
PID 2888 wrote to memory of 2100	2888	7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe	84
PID 2888 wrote to memory of 2100	2888	7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe	84
PID 2100 wrote to memory of 2168	2100	Synaptics.exe	85
PID 2100 wrote to memory of 2168	2100	Synaptics.exe	85
PID 2100 wrote to memory of 2168	2100	Synaptics.exe	85
PID 2168 wrote to memory of 2736	2168	._cache_Synaptics.exe	87
PID 2168 wrote to memory of 2736	2168	._cache_Synaptics.exe	87
PID 2168 wrote to memory of 2736	2168	._cache_Synaptics.exe	87

C:\Users\Admin\AppData\Local\Temp\7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe
"C:\Users\Admin\AppData\Local\Temp\7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\._cache_7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
    "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4604
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe" InjUpdate _?=C:\Users\Admin\AppData\Local\Temp\
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2736

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 917KB
SHA256 7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246
MD5 6a494fc8075128e4cdc44df078371830
SHA1 40640cea034b31b470d960df6e09b165d143562f
SHA512 50e8730b47b9108fba93745acc7c34ce14dd8c2d82af46a9f0348f44ed57389a9c383006d751b71fda8f99a75bd393e7c0e07be536c7bf973ca4921c2dd6c5f6
SSDEEP 12288:wMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9nr3I5sUesDns6BAeRv:wnsJ39LyjbJkQFMhmC+6GD9r3+sXqnrF
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_7ad3a341237a93ceb1e198d93b93f52b375eeed3c290a8dc1e5adef39b9eb246N.exe
Size 163KB
SHA256 ac55f3efd59c6a2d42251f0109f5fa713b806fdfc12511da2b2a09858fe81d01
MD5 b540b17cf251a822024653ff44165eb9
SHA1 ed98b5af3c4b1823659672d64236632fcc18a3d3
SHA512 e4ed1808cd578941ebc7d55a174714fb78743a8ea654b98e4ff9409db9acc06f2624e6d0f822cc09bbfad6d1f532ec9977cefec761dd02442ff86fa39738ee66
SSDEEP 3072:yr+Y8MQJFaqvkpqwPtwlULasDns6uYChzjxfGgaEsuNyPCtKR0mv8D:++mKI5twlULasDns6uYozF5OwVkS6E
MD5 SHA1 SHA512 SSDEEP

Submit Download

66775E00

Path C:\Users\Admin\AppData\Local\Temp\66775E00
Size 22KB
SHA256 07eb2ac65eae185b6136ce17b0c5b3a407b4436e46d7e067c0f53720f45a2592
MD5 69826ae8f948a60013ce98473fc37f24
SHA1 a74f3d4f6e90a8dfb3b00d3df39fc4d6ae78cf13
SHA512 261dad0e4a3938aac2d3f6f6c45a880535d09dd8c5d204f6bf02be497392f513028359987c8b9e54adc950e4ffe48584989d017767deb0b1ade003d32e70b943
SSDEEP 384:M+wW227LHkkbbp+o5bnJcX23Jp1cVKW+WfnqNDR6SG2kuy2qq13j:MpWL7Rf4o5bW25fclnqNcSikqq13j
MD5 SHA1 SHA512 SSDEEP

Submit Download

UXwE6R6g.xlsm

Path C:\Users\Admin\AppData\Local\Temp\UXwE6R6g.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

NSISGameExplorerPlugin.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv6DDE.tmp\NSISGameExplorerPlugin.dll
Size 100KB
SHA256 32fa6bae573848b5123734672039e808c9ce93e781f01e619b959c6c4e8fde72
MD5 0c2020b9cebdefe01d1ab1bf079ead52
SHA1 17bdbefce3f24c7b8817bb0499ef407f4bf0df2d
SHA512 fea74de5eca2d90fe6b35d3ad40ad2b7527448a5cd9f75eb2d549d4aa5e8cbb410a3d9a3b1f3a861689c5f45b949c87090f0349ad57f5918dd1b27e7b26b61fc
SSDEEP 1536:AqV12BONSINktv/L/52YrzW7kM7FagVvgrcr:PVVSV/8qCktQvg
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv6DDE.tmp\System.dll
Size 9KB
SHA256 60e6e287828dd882447a79018b505bb3be67b0f04fc8e022a57442e249588ed1
MD5 0e4c4e4eb158e3f250ca9161156e74a5
SHA1 78d055856312c2b9f313877f7f72ca936554095a
SHA512 eba47ef4d16532df26f50e42bb5650733844ffc94b6f0e9037c2a2854326e9bcf1d6c967f541a655a91452c9357eb4ba1aedf85a2757a560ad4527a8f6b63ebc
SSDEEP 96:F6MvJGp7txVLdOEuRKfUv2GS45RJZhrks19LbXJs2Wt9NlUUcXLEPSStL:iZL0iU+Gx5RfNF9vCt5bltL
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv6DDE.tmp\UserInfo.dll
Size 3KB
SHA256 921d31307a7e93270caa35093893b1799b055ffde2db3298fb9aa495ede7f9a2
MD5 1923c3ce705616293c721d5dfc46b7a3
SHA1 beec6bba81cc80e100243e6b26554e0c585f7734
SHA512 b8d584db8fac7a8395e3e5e1fdf12c4d3e5d1bdd78ac00e7467b5c4d279c670834211076ada391b6f11fb833fc8b54f2b3b24d9ecd85727000b1c0138aac8b77
MD5 SHA1 SHA512

Submit Download

WT_Plugin.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv6DDE.tmp\WT_Plugin.dll
Size 164KB
SHA256 0e6a43834e7124c784f958756330dbdcba32bc397bc96fd8ce1672c8c173be27
MD5 9f392fdef8b0681254ad916cf0cf6961
SHA1 ef903a0652696e5c0aad1b271916a1c212bdcee1
SHA512 5835042e78caea5ac25b2ce7c0490643c37890dd83424bf521ed67a97e2faaf95e2f8d9e7626b71f78c1d40e93dd61d3a175d149cf932042101d39fc09c2a77c
SSDEEP 3072:vfVsuKQwAI+qDC9VK84fDXgnmKXYEJUyrqRJIUCrK9wcJlFeLiUAQJ:Eu9bA8mKXYEJRo/zEL3
MD5 SHA1 SHA512 SSDEEP

Submit Download

~$UXwE6R6g.xlsm

Path C:\Users\Admin\AppData\Local\Temp\~$UXwE6R6g.xlsm
Size 165B
SHA256 e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
MD5 ff09371174f7c701e75f357a187c06e8
SHA1 57f9a638fd652922d7eb23236c80055a91724503
SHA512 e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
MD5 SHA1 SHA512

Submit Download

memory/2100-352-0x0000000000400000-0x00000000004EB000-memory.dmp

Download

memory/2100-321-0x0000000000400000-0x00000000004EB000-memory.dmp

Download

memory/2736-312-0x0000000003010000-0x000000000302B000-memory.dmp

Download

memory/2888-0-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/2888-142-0x0000000000400000-0x00000000004EB000-memory.dmp

Download

memory/4108-209-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Download

memory/4108-223-0x00007FFD91700000-0x00007FFD91710000-memory.dmp

Download

memory/4108-222-0x00007FFD91700000-0x00007FFD91710000-memory.dmp

Download

memory/4108-207-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Download

memory/4108-208-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Download

memory/4108-212-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Download

memory/4108-211-0x00007FFD93990000-0x00007FFD939A0000-memory.dmp

Download

memory/4604-292-0x0000000004180000-0x000000000419B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads