xred | 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761

Analysis

max time kernel
120s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
Size

917KB
MD5

28d5c70bf040b71fc7863ebc2891c661
SHA1

853e7527e524397fff7118b4442955ca03b231f5
SHA256

90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761
SHA512

3a2ac093d9d3e0cd102c7e72d7a0512457db361335cc6373ea4aad01f14e3bd8c5f6e0520778c4ab05487426c12522c86cfcb1180a11d5f98ed3a6922f946288
SSDEEP

12288:wMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9nr3I5sUesDns6BAeRF:wnsJ39LyjbJkQFMhmC+6GD9r3+sXqnrX

Score

10^/10

xred backdoor discovery macro persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

Processes:

resource
C:\Users\Admin\AppData\Local\Temp\b3ua6DST.xlsm

Deletes itself 1 IoCs

Processes:

Au_.exe

pid process

2704 Au_.exe

pid	process
2704	Au_.exe

Executes dropped EXE 5 IoCs

Processes:

._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exeAu_.exeSynaptics.exe._cache_Synaptics.exeBu_.exe

pid	process
2548	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
2704	Au_.exe
2744	Synaptics.exe
2648	._cache_Synaptics.exe
1860	Bu_.exe

Loads dropped DLL 17 IoCs

Processes:

90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exeAu_.exeSynaptics.exe._cache_Synaptics.exeBu_.exe

pid	process
2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
2548	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
2704	Au_.exe
2704	Au_.exe
2744	Synaptics.exe
2744	Synaptics.exe
2648	._cache_Synaptics.exe
1860	Bu_.exe
1860	Bu_.exe
2704	Au_.exe
1860	Bu_.exe
2704	Au_.exe
1860	Bu_.exe
2704	Au_.exe
1860	Bu_.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exeAu_.exeSynaptics.exe._cache_Synaptics.exeBu_.exeEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bu_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

NSIS installer 1 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	nsis_installer_1

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2668 EXCEL.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EXCEL.EXE

pid process

2668 EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
2668	EXCEL.EXE

pid	process
2668	EXCEL.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exeSynaptics.exe._cache_Synaptics.exe

description	pid	process	target process
PID 2284 wrote to memory of 2548	2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2284 wrote to memory of 2548	2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2284 wrote to memory of 2548	2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2284 wrote to memory of 2548	2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2284 wrote to memory of 2548	2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2284 wrote to memory of 2548	2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2284 wrote to memory of 2548	2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2548 wrote to memory of 2704	2548	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2548 wrote to memory of 2704	2548	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2548 wrote to memory of 2704	2548	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2548 wrote to memory of 2704	2548	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2548 wrote to memory of 2704	2548	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2548 wrote to memory of 2704	2548	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2548 wrote to memory of 2704	2548	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2284 wrote to memory of 2744	2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Synaptics.exe
PID 2284 wrote to memory of 2744	2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Synaptics.exe
PID 2284 wrote to memory of 2744	2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Synaptics.exe
PID 2284 wrote to memory of 2744	2284	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Synaptics.exe
PID 2744 wrote to memory of 2648	2744	Synaptics.exe	._cache_Synaptics.exe
PID 2744 wrote to memory of 2648	2744	Synaptics.exe	._cache_Synaptics.exe
PID 2744 wrote to memory of 2648	2744	Synaptics.exe	._cache_Synaptics.exe
PID 2744 wrote to memory of 2648	2744	Synaptics.exe	._cache_Synaptics.exe
PID 2744 wrote to memory of 2648	2744	Synaptics.exe	._cache_Synaptics.exe
PID 2744 wrote to memory of 2648	2744	Synaptics.exe	._cache_Synaptics.exe
PID 2744 wrote to memory of 2648	2744	Synaptics.exe	._cache_Synaptics.exe
PID 2648 wrote to memory of 1860	2648	._cache_Synaptics.exe	Bu_.exe
PID 2648 wrote to memory of 1860	2648	._cache_Synaptics.exe	Bu_.exe
PID 2648 wrote to memory of 1860	2648	._cache_Synaptics.exe	Bu_.exe
PID 2648 wrote to memory of 1860	2648	._cache_Synaptics.exe	Bu_.exe
PID 2648 wrote to memory of 1860	2648	._cache_Synaptics.exe	Bu_.exe
PID 2648 wrote to memory of 1860	2648	._cache_Synaptics.exe	Bu_.exe
PID 2648 wrote to memory of 1860	2648	._cache_Synaptics.exe	Bu_.exe

C:\Users\Admin\AppData\Local\Temp\90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
"C:\Users\Admin\AppData\Local\Temp\90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
    "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2704
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe" InjUpdate _?=C:\Users\Admin\AppData\Local\Temp\
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1860

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
917KB

MD5
28d5c70bf040b71fc7863ebc2891c661

SHA1
853e7527e524397fff7118b4442955ca03b231f5

SHA256
90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761

SHA512
3a2ac093d9d3e0cd102c7e72d7a0512457db361335cc6373ea4aad01f14e3bd8c5f6e0520778c4ab05487426c12522c86cfcb1180a11d5f98ed3a6922f946288

Download Submit
C:\Users\Admin\AppData\Local\Temp\b3ua6DST.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\b3ua6DST.xlsm

Filesize
20KB

MD5
a218ea9c57d158fb2cd2dc84b39c9146

SHA1
34be906270cdc42443402ca0a92e17b6e9b735b2

SHA256
1dba29d44b98fd037f628fceb818f4d84a8cf1bbf7ea86508549b650b9700d60

SHA512
019a88df3a85fb9c802200feb900cb1c88ca2948c471b49bfa5798e023816fcee50034e8f3a44dcf1fcc6e2fc02c7de01581f6aa968a41fe374aa844bfb092a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\b3ua6DST.xlsm

Filesize
23KB

MD5
1ba8e90bb0e56f929b0e855db7521089

SHA1
a457ecc5b816734134905b8c6be42d4e014677a9

SHA256
68c2cecc03daa331cfb119f06d24dc630404acb10dfcea6039d09e2343c80b9c

SHA512
2d75c3e40cfb288b5ea87dce76721977ca978f83fc40715d92272bbbcb593dbf8d392f3888f7d500355ee4a468d5817a0b75ce0ed907179c09cc717178e69a6a

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe

Filesize
163KB

MD5
b540b17cf251a822024653ff44165eb9

SHA1
ed98b5af3c4b1823659672d64236632fcc18a3d3

SHA256
ac55f3efd59c6a2d42251f0109f5fa713b806fdfc12511da2b2a09858fe81d01

SHA512
e4ed1808cd578941ebc7d55a174714fb78743a8ea654b98e4ff9409db9acc06f2624e6d0f822cc09bbfad6d1f532ec9977cefec761dd02442ff86fa39738ee66

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9010.tmp\NSISGameExplorerPlugin.dll

Filesize
100KB

MD5
0c2020b9cebdefe01d1ab1bf079ead52

SHA1
17bdbefce3f24c7b8817bb0499ef407f4bf0df2d

SHA256
32fa6bae573848b5123734672039e808c9ce93e781f01e619b959c6c4e8fde72

SHA512
fea74de5eca2d90fe6b35d3ad40ad2b7527448a5cd9f75eb2d549d4aa5e8cbb410a3d9a3b1f3a861689c5f45b949c87090f0349ad57f5918dd1b27e7b26b61fc

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9010.tmp\System.dll

Filesize
9KB

MD5
0e4c4e4eb158e3f250ca9161156e74a5

SHA1
78d055856312c2b9f313877f7f72ca936554095a

SHA256
60e6e287828dd882447a79018b505bb3be67b0f04fc8e022a57442e249588ed1

SHA512
eba47ef4d16532df26f50e42bb5650733844ffc94b6f0e9037c2a2854326e9bcf1d6c967f541a655a91452c9357eb4ba1aedf85a2757a560ad4527a8f6b63ebc

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9010.tmp\UserInfo.dll

Filesize
3KB

MD5
1923c3ce705616293c721d5dfc46b7a3

SHA1
beec6bba81cc80e100243e6b26554e0c585f7734

SHA256
921d31307a7e93270caa35093893b1799b055ffde2db3298fb9aa495ede7f9a2

SHA512
b8d584db8fac7a8395e3e5e1fdf12c4d3e5d1bdd78ac00e7467b5c4d279c670834211076ada391b6f11fb833fc8b54f2b3b24d9ecd85727000b1c0138aac8b77

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9010.tmp\WT_Plugin.dll

Filesize
164KB

MD5
9f392fdef8b0681254ad916cf0cf6961

SHA1
ef903a0652696e5c0aad1b271916a1c212bdcee1

SHA256
0e6a43834e7124c784f958756330dbdcba32bc397bc96fd8ce1672c8c173be27

SHA512
5835042e78caea5ac25b2ce7c0490643c37890dd83424bf521ed67a97e2faaf95e2f8d9e7626b71f78c1d40e93dd61d3a175d149cf932042101d39fc09c2a77c

Download Submit
memory/1860-154-0x0000000001F00000-0x0000000001F1B000-memory.dmp

Filesize
108KB

Download
memory/2284-36-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2284-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2668-69-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2668-123-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2704-148-0x00000000026E0000-0x00000000026FB000-memory.dmp

Filesize
108KB

Download
memory/2744-170-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2744-171-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2744-172-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2744-180-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2744-204-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download