Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/11/2024, 22:32
General
-
Target
53d3b6cc06ee113cbd59a565031adfed27d71b5bae796b8cd3eb576f7ec240bd.exe
-
Size
5.4MB
-
MD5
4db70309f142abf1c95862ce47770e84
-
SHA1
8fa99d3efa3a61541e6bebccc8ad654b4c2c0f0b
-
SHA256
53d3b6cc06ee113cbd59a565031adfed27d71b5bae796b8cd3eb576f7ec240bd
-
SHA512
f7a8df39a4e41eeb375081783826e083e0e6992189eb7a4d40bd89adcb7d0de96b0e42925b1b52df8cfb55880e375d234786049812c235634170d13374416390
-
SSDEEP
98304:onsmtk2aHlEG8zU9zHsuWTTsAQ4t0/AH3V3SYlpVoyS+fW9eo+tXVe/PMMsFK:2L56TiTsAQ+0gBdlrrfW0o+dVeHMMsFK
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 35 IoCs
-
Drops file in Program Files directory 21 IoCs
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NSIS installer 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies data under HKEY_USERS 41 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\53d3b6cc06ee113cbd59a565031adfed27d71b5bae796b8cd3eb576f7ec240bd.exe"C:\Users\Admin\AppData\Local\Temp\53d3b6cc06ee113cbd59a565031adfed27d71b5bae796b8cd3eb576f7ec240bd.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_53d3b6cc06ee113cbd59a565031adfed27d71b5bae796b8cd3eb576f7ec240bd.exe"C:\Users\Admin\AppData\Local\Temp\._cache_53d3b6cc06ee113cbd59a565031adfed27d71b5bae796b8cd3eb576f7ec240bd.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\GS-911\GS911USBDrv\DPInstx64.exe"C:\Program Files (x86)\GS-911\GS911USBDrv\DPInstx64.exe" /S4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
-
C:\Program Files (x86)\GS-911\GS-911.exe"C:\Program Files (x86)\GS-911\GS-911.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{5a4d5fa7-2b6a-b64d-9459-81957212bada}\gs911usb.inf" "9" "492de6ad3" "0000000000000154" "WinSta0\Default" "00000000000000BC" "208" "c:\program files (x86)\gs-911\gs911usbdrv"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221KB
MD5932c49e7a84c37a9191212489e037126
SHA1865940ad4792d0715fe87a42dce20589a768db5b
SHA256c80c16c3278973566efafb2ebe8102d9adfaf6cbebed28d4a1d3abc72043c7fa
SHA51245c2c1b25eba58421de61b1fda53379cd730baeaf365bac2dd89f49853933e21512f9c09e0377c42bf50371ea64989fae2060f3401ec9369452b10baf77bc5f9
-
Filesize
3.6MB
MD5aba145d1de91ab1e0ba679410e353ff2
SHA11f539de1f809327ea24c57234daffb1f0b4605ee
SHA256e52d79d132e87de8a49a7ea21e1263fc70a36f885ea5ddbd0965853791fab76a
SHA5124c00dc2d6795af7acfcbecf32222c04711db68aa4a1ea10c8092f3621c97f24128987fd78f554dc515f82b764e9cf4b0aec3ac6750b630d8b395d606b26e1302
-
Filesize
913KB
MD5e90140ff5f5ff7521ea52f94bec29f8c
SHA1a3aaf4d6705984d2f0b97d277766ebc82a26011f
SHA2560e25afc6f2c17e08afc91f7717b3669cb4de6f77dd62b78674b09e0d59e4aa3c
SHA512f644e4c22be81aeddf380ec8b550c3774a6c8678b9ad4cb210235ae440bd9f1e16df84832babac21672b69a57ebd779bbfb562dd6158f91cc48367ef3e383a3e
-
Filesize
13KB
MD52ce15983845fc5b5c53ae69f21d2baa6
SHA16866742752b1f8ecf274c82b1930ed716301284e
SHA256f88031b99044ec310c196d773560a056fe4edcbda07cddd0d6e32722e783d162
SHA512a07b5b21fe7508ba463994d7690f080751dd54100e1f22ef49c532e0de1a30a456043347f403369a7bf713d5f9a266bc9ed9f9ea17f715e7648936e13611feb5
-
Filesize
5.4MB
MD54db70309f142abf1c95862ce47770e84
SHA18fa99d3efa3a61541e6bebccc8ad654b4c2c0f0b
SHA25653d3b6cc06ee113cbd59a565031adfed27d71b5bae796b8cd3eb576f7ec240bd
SHA512f7a8df39a4e41eeb375081783826e083e0e6992189eb7a4d40bd89adcb7d0de96b0e42925b1b52df8cfb55880e375d234786049812c235634170d13374416390
-
Filesize
4.7MB
MD54170a6583b6a182f9c2f4295574fc171
SHA1e61f16339ca634759113142f0fddb4012afaf41b
SHA256033e46c4e8a5c135e610db0d7617f19aa3926f974b7157be3a27e4082e5bf33b
SHA5128bd7d2bfeef83221606075d16d5b1cf82919409c1e4c8edf5417a63373109a591ebbceb0ee827f9666c9dc341dd13226f525c4013008b621c0e5857164a7bc0f
-
Filesize
20KB
MD52bbd5f6a58b704e3e0ca28e07fbb1715
SHA1457ef6084c5e27abbb0c65e46eedfdca5e520491
SHA2566dc523021b2f15619327d12903489d7a7e358cbbf1c665ba9dacd2e338afe9e4
SHA512e5ee38933588cbbf023f2a0d4b5452620a46ea1a5584ccc72cc42e7341d4a31784439b57fb2aa9a9f90fbdc454b97ee42557ac9f39d501f35b94541e222bb88a
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
9KB
MD5c10e04dd4ad4277d5adc951bb331c777
SHA1b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
-
Filesize
59KB
MD508843db87aa2c66a11ac2b9c8df5d56b
SHA18a62cf7547eb01fa673d9e3bb7d099fa977c7fa1
SHA256f0ac28d6b30826a2fc5b818ba0841feb0888a12e5c6016f02d2b904f104a1f63
SHA51243e7181e0ece1b8d2454a6ac782c43c514009ccab842c85dd736e7294124c405ffab98d72ca66ba9719c086f037b33e1767ea6cb7fde25de28daa829ab2e9bda
-
Filesize
74B
MD52acc664fa9af6908f9565738ff68d856
SHA1b4a4047727f172b01da40d76bc19330b36787a82
SHA256989f2b445ea52a202f38144a45c2726951a831962b635347f915d5e145244ff0
SHA512aa3b768579b7e054fb55eca36d177043fe2704ba66e6ebfa8837511e06371a9694b1308d02c6801c81084ac43b03970fcce6a515bdaac957f42d488619971521
-
Filesize
37KB
MD55cfe52f8a433eff33c5bef8c35ab5c8a
SHA1a159278fcaf66f8e8ccf846010cbde509bbcb592
SHA256330e333035cf4a07b97a5a4d86e0547fce56df7bf0ba195153ab3766e430be84
SHA512c8a71acd0c8b252eb5e8b3915e5d63143d89ab2d820879945787aa1ee167cc91fdf66d6d7cb56c7d74b1aaf56bf2ae4c1f553c333eb34659a951359eed141338
-
Filesize
67KB
MD50f210048c6bfbfbc0f50816bce40b575
SHA12fd94cfbfd8dd4a2edd004f1c6cc50b926529258
SHA25673c015b6ee647a875bd124254542ff8759264d51f331ff95d14675c1599fad94
SHA5129d37b1cdf2a39fdd6a9215839d1a7b4e538b31ae7f8f0c2e0de39434f337ea8f440112e8d8198d93f53602a7d9260d9eb41ecacf91aa38feba1c360b17a945a8
-
Filesize
313KB
MD5e2df9664d8e158efffc4f3cd0fde15e8
SHA154352e4470af8756b1c0a222cbf7e48264ac1920
SHA25640b71c4eab9b8b6801bab4575a64fea73961471aa8bdfc11083a3890f9bc7c30
SHA512d4f939caedd5c81732f9317c90acba9d7562205c293ebb22f9569f87e4486189a52bb1bd455896db611ec665701a104a63ac1a8d3f856854fc008f2923678d02
-
Filesize
140KB
MD5aa15b12108b05f07669a2bc6e7c6365c
SHA19cb7482822e50ed233613678efa7a8ca9bd7b377
SHA256ef32ba13d527d5f52c9196b6c48fe7af8592837f3424ebe47450a2c62bd7a6e7
SHA51269cfaecdd7f007f60ca26cd53c0f191582845f6340c85bdc5961786fde22ef09c1d55335246961d4522d30b00119de1f2e6548126bbc1f16efe863cc9076a06a
-
Filesize
263KB
MD563c18cc6ff6130215d14c8212b1bd450
SHA12d9c88113da0090b96549f49e2341e18c85d80c5
SHA256a68ed4225cde423e8d2f2774ff26986b1b2e8b2c5b05412f95f5319cb5bf78e2
SHA512b8ee9e5b9d3fd14717c60f671da16c6bef4bfa7e018e483d45cac9cbd28de9d958fa2fad90b417b825b3fd438d76a67fcf9a16bcc281bdd64c2ab858b9233ff8
-
Filesize
11KB
MD520a4a148648f75704c7fdbeb03aa0eab
SHA183d4f551a90ea691f9add59bc8f19968051c8f85
SHA25667515f99ce3bff25d560d3bdc8b4cdf16d06e96a8eb31f36c2cb49a54355246f
SHA512e8ffa41747c04de1cc3d8406c29298fd4e80b40e8de818dafac2a3676ee0877f7c6e5a33e4d958f377f62c45f80c57eda368dcb55c4173d5ee24ab6cf98a0413
-
Filesize
197KB
MD59adbed60e17690bd72e3ab134cc97bbd
SHA1d9a7e8b8f162ecc459b2c2f6c3f68baed5e7814a
SHA256b052d6dcf61b864e948743cd02c29f0bf80f94e6c705bc4dbe858b55eeabbbb2
SHA51280cbee076552dcb4d49eaa355d96e9a81d475c85b3a5b1fe561e3e0eda9ee0400c9fc2c9eadba8d8a4edb0156a5a4213fc34043e72a4930e107108a8989b83ea
-
Filesize
2KB
MD576a15fb2488648bd174d900dd6a9778c
SHA1af3ba36231290959b70f0ccfb2c4cd2708efb384
SHA2568e05016985541fa9fc702b7bc586fc6e183167a6ef37693d80885c2e2c6550e1
SHA512010c9cdf7524f0467c96ba59a03da4f6e70e35a6361b0d28d268638d9487e6a1d3cbaab46d3e2e732c676ec2e9d0901e57bb436a11593f4a854ed746b34ab063
-
Filesize
5.4MB
-
Filesize
4KB
-
Filesize
5.4MB
-
Filesize
5.4MB
-
Filesize
5.4MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB