xred | 90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761

General

Target

90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
Size

917KB
MD5

28d5c70bf040b71fc7863ebc2891c661
SHA1

853e7527e524397fff7118b4442955ca03b231f5
SHA256

90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761
SHA512

3a2ac093d9d3e0cd102c7e72d7a0512457db361335cc6373ea4aad01f14e3bd8c5f6e0520778c4ab05487426c12522c86cfcb1180a11d5f98ed3a6922f946288
SSDEEP

12288:wMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9nr3I5sUesDns6BAeRF:wnsJ39LyjbJkQFMhmC+6GD9r3+sXqnrX

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred
Deletes itself 1 IoCs

Processes:

Bu_.exe

pid process

2848 Bu_.exe

pid	process
2848	Bu_.exe

Executes dropped EXE 5 IoCs

Processes:

._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exeAu_.exeSynaptics.exe._cache_Synaptics.exeBu_.exe

pid	process
2588	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
2648	Au_.exe
2824	Synaptics.exe
1652	._cache_Synaptics.exe
2848	Bu_.exe

Loads dropped DLL 17 IoCs

Processes:

90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exeAu_.exeSynaptics.exe._cache_Synaptics.exeBu_.exe

pid	process
2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
2588	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
2648	Au_.exe
2648	Au_.exe
2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
2824	Synaptics.exe
2824	Synaptics.exe
1652	._cache_Synaptics.exe
2848	Bu_.exe
2848	Bu_.exe
2848	Bu_.exe
2648	Au_.exe
2648	Au_.exe
2648	Au_.exe
2848	Bu_.exe
2848	Bu_.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Au_.exeSynaptics.exe._cache_Synaptics.exeEXCEL.EXEBu_.exe90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bu_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe

NSIS installer 1 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	nsis_installer_1

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3016 EXCEL.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EXCEL.EXE

pid process

3016 EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
3016	EXCEL.EXE

pid	process
3016	EXCEL.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exeSynaptics.exe._cache_Synaptics.exe

description	pid	process	target process
PID 2584 wrote to memory of 2588	2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2584 wrote to memory of 2588	2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2584 wrote to memory of 2588	2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2584 wrote to memory of 2588	2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2584 wrote to memory of 2588	2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2584 wrote to memory of 2588	2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2584 wrote to memory of 2588	2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
PID 2588 wrote to memory of 2648	2588	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2588 wrote to memory of 2648	2588	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2588 wrote to memory of 2648	2588	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2588 wrote to memory of 2648	2588	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2588 wrote to memory of 2648	2588	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2588 wrote to memory of 2648	2588	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2588 wrote to memory of 2648	2588	._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Au_.exe
PID 2584 wrote to memory of 2824	2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Synaptics.exe
PID 2584 wrote to memory of 2824	2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Synaptics.exe
PID 2584 wrote to memory of 2824	2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Synaptics.exe
PID 2584 wrote to memory of 2824	2584	90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe	Synaptics.exe
PID 2824 wrote to memory of 1652	2824	Synaptics.exe	._cache_Synaptics.exe
PID 2824 wrote to memory of 1652	2824	Synaptics.exe	._cache_Synaptics.exe
PID 2824 wrote to memory of 1652	2824	Synaptics.exe	._cache_Synaptics.exe
PID 2824 wrote to memory of 1652	2824	Synaptics.exe	._cache_Synaptics.exe
PID 2824 wrote to memory of 1652	2824	Synaptics.exe	._cache_Synaptics.exe
PID 2824 wrote to memory of 1652	2824	Synaptics.exe	._cache_Synaptics.exe
PID 2824 wrote to memory of 1652	2824	Synaptics.exe	._cache_Synaptics.exe
PID 1652 wrote to memory of 2848	1652	._cache_Synaptics.exe	Bu_.exe
PID 1652 wrote to memory of 2848	1652	._cache_Synaptics.exe	Bu_.exe
PID 1652 wrote to memory of 2848	1652	._cache_Synaptics.exe	Bu_.exe
PID 1652 wrote to memory of 2848	1652	._cache_Synaptics.exe	Bu_.exe
PID 1652 wrote to memory of 2848	1652	._cache_Synaptics.exe	Bu_.exe
PID 1652 wrote to memory of 2848	1652	._cache_Synaptics.exe	Bu_.exe
PID 1652 wrote to memory of 2848	1652	._cache_Synaptics.exe	Bu_.exe

C:\Users\Admin\AppData\Local\Temp\90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
"C:\Users\Admin\AppData\Local\Temp\90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
    "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2648
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Bu_.exe" InjUpdate _?=C:\Users\Admin\AppData\Local\Temp\
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2848

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
917KB

MD5
28d5c70bf040b71fc7863ebc2891c661

SHA1
853e7527e524397fff7118b4442955ca03b231f5

SHA256
90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761

SHA512
3a2ac093d9d3e0cd102c7e72d7a0512457db361335cc6373ea4aad01f14e3bd8c5f6e0520778c4ab05487426c12522c86cfcb1180a11d5f98ed3a6922f946288

Download Submit
C:\Users\Admin\AppData\Local\Temp\EXnsIDf8.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC85F.tmp\UserInfo.dll

Filesize
3KB

MD5
1923c3ce705616293c721d5dfc46b7a3

SHA1
beec6bba81cc80e100243e6b26554e0c585f7734

SHA256
921d31307a7e93270caa35093893b1799b055ffde2db3298fb9aa495ede7f9a2

SHA512
b8d584db8fac7a8395e3e5e1fdf12c4d3e5d1bdd78ac00e7467b5c4d279c670834211076ada391b6f11fb833fc8b54f2b3b24d9ecd85727000b1c0138aac8b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyCA71.tmp\WT_Plugin.dll

Filesize
164KB

MD5
9f392fdef8b0681254ad916cf0cf6961

SHA1
ef903a0652696e5c0aad1b271916a1c212bdcee1

SHA256
0e6a43834e7124c784f958756330dbdcba32bc397bc96fd8ce1672c8c173be27

SHA512
5835042e78caea5ac25b2ce7c0490643c37890dd83424bf521ed67a97e2faaf95e2f8d9e7626b71f78c1d40e93dd61d3a175d149cf932042101d39fc09c2a77c

Download Submit
C:\Users\Admin\AppData\Local\Temp\~$EXnsIDf8.xlsm

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_90622f04f300414e5d41407f959bbe04f48b428ae524d8b0d8bb7441becd8761.exe

Filesize
163KB

MD5
b540b17cf251a822024653ff44165eb9

SHA1
ed98b5af3c4b1823659672d64236632fcc18a3d3

SHA256
ac55f3efd59c6a2d42251f0109f5fa713b806fdfc12511da2b2a09858fe81d01

SHA512
e4ed1808cd578941ebc7d55a174714fb78743a8ea654b98e4ff9409db9acc06f2624e6d0f822cc09bbfad6d1f532ec9977cefec761dd02442ff86fa39738ee66

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC85F.tmp\NSISGameExplorerPlugin.dll

Filesize
100KB

MD5
0c2020b9cebdefe01d1ab1bf079ead52

SHA1
17bdbefce3f24c7b8817bb0499ef407f4bf0df2d

SHA256
32fa6bae573848b5123734672039e808c9ce93e781f01e619b959c6c4e8fde72

SHA512
fea74de5eca2d90fe6b35d3ad40ad2b7527448a5cd9f75eb2d549d4aa5e8cbb410a3d9a3b1f3a861689c5f45b949c87090f0349ad57f5918dd1b27e7b26b61fc

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC85F.tmp\System.dll

Filesize
9KB

MD5
0e4c4e4eb158e3f250ca9161156e74a5

SHA1
78d055856312c2b9f313877f7f72ca936554095a

SHA256
60e6e287828dd882447a79018b505bb3be67b0f04fc8e022a57442e249588ed1

SHA512
eba47ef4d16532df26f50e42bb5650733844ffc94b6f0e9037c2a2854326e9bcf1d6c967f541a655a91452c9357eb4ba1aedf85a2757a560ad4527a8f6b63ebc

Download Submit
memory/2584-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2584-42-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2648-111-0x00000000025A0000-0x00000000025BB000-memory.dmp

Filesize
108KB

Download
memory/2824-135-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2824-136-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2824-168-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2848-119-0x0000000000470000-0x000000000048B000-memory.dmp

Filesize
108KB

Download
memory/3016-59-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads