xred | c607874b368fff6c26292126aeac27da8fcaecee807a8da0550f3d8bc7580a80

Resubmissions

29/11/2024, 09:17

241129-k87csaxmcx10

28/12/2023, 10:04

231228-l37xsschf23

Analysis

max time kernel
30s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2024, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
em.exe
Size 2.5MB
Sample241129-k87csaxmcx
SHA256 a8eea05d025c95fa51597a49564806ddfbadc635bc407c25b04059a1cdc5555a
MD5 ef18fa16022ae67b86b21bb1aa145fc0
SHA1 90aa33fcd1407fc9c672a0b00a3c9c3c2735984f
SHA512 088d7924ffb0f160cccd898f9cca91c410d8b82705f1488fdc3e392437b364a5bf6b11f7c52235e40726eeaec9974eea2f5f75dd5eb17c15a17f3a0ee20fd32b
SSDEEP 24576:JnsJ39LyjbJkQFMhmC+6GD9jk7UHhd1IvGGC0qsu/:JnsHyjtk2MYC5GD7BkGGC0M/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	em.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 3 IoCs

pid	Process
1296	._cache_em.exe
3580	Synaptics.exe
3260	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	em.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	em.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_em.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	._cache_em.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	._cache_em.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	em.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1200	EXCEL.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1200	EXCEL.EXE
1200	EXCEL.EXE
1200	EXCEL.EXE
1200	EXCEL.EXE
1200	EXCEL.EXE
1200	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 1296	3716	em.exe	82
PID 3716 wrote to memory of 1296	3716	em.exe	82
PID 3716 wrote to memory of 1296	3716	em.exe	82
PID 3716 wrote to memory of 3580	3716	em.exe	84
PID 3716 wrote to memory of 3580	3716	em.exe	84
PID 3716 wrote to memory of 3580	3716	em.exe	84
PID 3580 wrote to memory of 3260	3580	Synaptics.exe	85
PID 3580 wrote to memory of 3260	3580	Synaptics.exe	85
PID 3580 wrote to memory of 3260	3580	Synaptics.exe	85

C:\Users\Admin\AppData\Local\Temp\em.exe
"C:\Users\Admin\AppData\Local\Temp\em.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\AppData\Local\Temp\._cache_em.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_em.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:1296
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:3260

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 2.5MB
SHA256 a8eea05d025c95fa51597a49564806ddfbadc635bc407c25b04059a1cdc5555a
MD5 ef18fa16022ae67b86b21bb1aa145fc0
SHA1 90aa33fcd1407fc9c672a0b00a3c9c3c2735984f
SHA512 088d7924ffb0f160cccd898f9cca91c410d8b82705f1488fdc3e392437b364a5bf6b11f7c52235e40726eeaec9974eea2f5f75dd5eb17c15a17f3a0ee20fd32b
SSDEEP 24576:JnsJ39LyjbJkQFMhmC+6GD9jk7UHhd1IvGGC0qsu/:JnsHyjtk2MYC5GD7BkGGC0M/
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_em.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_em.exe
Size 579KB
SHA256 421d3a7ffd9e76717b98ff9bcf78983b0caac67489058d08acd9960e43af414f
MD5 9487c902c64afe58ebeea571d0694ed8
SHA1 aceb11e91652315ecc1db2a38a21b95e4eb9247a
SHA512 d51d51e48c93dbefb9f7017e6582d1e2aeb1aaae8abb14c471cc61e02df3f4c3353c9752fd1e3d418400cb2de42420f17f233115fa57041b1e50af0ecb6b21a7
SSDEEP 12288:+Y6O1TObWUHuEd1InvMFVZLOu87Te03k/uAssx/:6k7UHhd1IvGGC0qsu/
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEB75E00

Path C:\Users\Admin\AppData\Local\Temp\DEB75E00
Size 23KB
SHA256 1347ae00e370328a8a21a18caa68963576b050a49e514f908359253fb24e8c4b
MD5 559cbc9b7fc2527b29a6cd0afae4b7c7
SHA1 dde0f516850761d0fd2114f45384372fceeb5324
SHA512 62c73013e2e1dfbc90d780821f82b7fa72d111755e96ace2cbe00a5e81155e7c34c3b1b6a2c16723369127d9b2f75a66f08b6fd2c085443aca192033d0de74a3
SSDEEP 384:Mad/a5n1Mp+o5bemhZgmoP5TO9M/0oCmyy43TqX8TGa5GmljUa:Madn4o5bemb7069M/Z43TqX45GmdUa
MD5 SHA1 SHA512 SSDEEP

Submit Download

bXw81TuU.xlsm

Path C:\Users\Admin\AppData\Local\Temp\bXw81TuU.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

em.rtf

Path C:\Users\Admin\AppData\Local\Temp\em.rtf
Size 3KB
SHA256 dead09dc38100764c4a4a8dda1eb9583b61ae078bbddccb16ec024d357b22fc4
MD5 6b3ce7f511fe02c8f1271c1d0f9cf13f
SHA1 d4bd48f676a4becd4127352751086902286fdb64
SHA512 29825d213b969232b79fe478940c4567257c8bcc7b9df6176b9ffcd57b2fa14a2b5386c63382ede7e2413ce9c5fabdb0e8c84190315aa2cdc0c56c4e0a6881a0
MD5 SHA1 SHA512

Submit Download

memory/1200-143-0x00007FFED2800000-0x00007FFED2810000-memory.dmp

Download

memory/1200-137-0x00007FFED5050000-0x00007FFED5060000-memory.dmp

Download

memory/1200-139-0x00007FFED5050000-0x00007FFED5060000-memory.dmp

Download

memory/1200-138-0x00007FFED5050000-0x00007FFED5060000-memory.dmp

Download

memory/1200-141-0x00007FFED5050000-0x00007FFED5060000-memory.dmp

Download

memory/1200-140-0x00007FFED5050000-0x00007FFED5060000-memory.dmp

Download

memory/1200-142-0x00007FFED2800000-0x00007FFED2810000-memory.dmp

Download

memory/3580-102-0x0000000000780000-0x0000000000781000-memory.dmp

Download

memory/3580-191-0x0000000000780000-0x0000000000781000-memory.dmp

Download

memory/3580-190-0x0000000000400000-0x0000000000693000-memory.dmp

Download

memory/3716-0-0x0000000002410000-0x0000000002411000-memory.dmp

Download

memory/3716-101-0x0000000000400000-0x0000000000693000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads