xred | bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164

General

Target

bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe
Size

974KB
MD5

6cc7cc8aaf0b53de841f7eab712bc9b0
SHA1

3f32bc2bd8e149dd87bedb9e1b15b4b0a73e28cd
SHA256

bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164
SHA512

64d102d89f6c73fce7625dbf3e8a3152a4a79deae47036a586313958b86ef405a011b1927c92113b45634bb4e73ca654090164679b31158cfc9e2043356f3d2a
SSDEEP

12288:fMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9aKGWasGWaMGWa8j:fnsJ39LyjbJkQFMhmC+6GD9zGEGEGk

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

Processes:

._cache_bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exeSynaptics.exe._cache_Synaptics.exe

pid	Process
2572	._cache_bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe
1816	Synaptics.exe
3016	._cache_Synaptics.exe

Loads dropped DLL 5 IoCs

Processes:

bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exeSynaptics.exe

pid	Process
2556	bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe
2556	bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe
2556	bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe
1816	Synaptics.exe
1816	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe._cache_bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exeSynaptics.exe._cache_Synaptics.exeEXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid	Process
1640	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

._cache_bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe._cache_Synaptics.exe

description	pid	Process
Token: SeDebugPrivilege	2572	._cache_bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe
Token: SeDebugPrivilege	3016	._cache_Synaptics.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EXCEL.EXE

pid	Process
1640	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exeSynaptics.exe

description	pid	Process	procid_target
PID 2556 wrote to memory of 2572	2556	bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe	31
PID 2556 wrote to memory of 2572	2556	bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe	31
PID 2556 wrote to memory of 2572	2556	bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe	31
PID 2556 wrote to memory of 2572	2556	bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe	31
PID 2556 wrote to memory of 1816	2556	bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe	32
PID 2556 wrote to memory of 1816	2556	bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe	32
PID 2556 wrote to memory of 1816	2556	bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe	32
PID 2556 wrote to memory of 1816	2556	bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe	32
PID 1816 wrote to memory of 3016	1816	Synaptics.exe	33
PID 1816 wrote to memory of 3016	1816	Synaptics.exe	33
PID 1816 wrote to memory of 3016	1816	Synaptics.exe	33
PID 1816 wrote to memory of 3016	1816	Synaptics.exe	33

C:\Users\Admin\AppData\Local\Temp\bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe
"C:\Users\Admin\AppData\Local\Temp\bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\._cache_bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3016

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
974KB

MD5
6cc7cc8aaf0b53de841f7eab712bc9b0

SHA1
3f32bc2bd8e149dd87bedb9e1b15b4b0a73e28cd

SHA256
bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164

SHA512
64d102d89f6c73fce7625dbf3e8a3152a4a79deae47036a586313958b86ef405a011b1927c92113b45634bb4e73ca654090164679b31158cfc9e2043356f3d2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vvnQSavi.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\vvnQSavi.xlsm

Filesize
25KB

MD5
0f986b5ec14cfbe1ccbc5d04645f4715

SHA1
87b72f9e0c394d738d7888cd435f79b83f633ead

SHA256
2a1a908a75131fa120a31ec7bdecf0ef86d41e0ec395dcd2e180f8320f076dcf

SHA512
a2de8b07d0e3e7a0871caf348e1fc7e520b7d3fb400f51374d8705c77a30f976ceeae62decb473f543308b7d9e3c6372bde8f05e64743c4e52e6d52f296c2d68

Download Submit
C:\Users\Admin\AppData\Local\Temp\vvnQSavi.xlsm

Filesize
21KB

MD5
f4f3e086dffd430a3a8b60c74abba22e

SHA1
78141013beb92310e77fde395acbf3bfae8d7fb4

SHA256
ae70d99521cdd5a5b817301d184e6179606da8e758e99ae474be83aedf662fbe

SHA512
8f2a12a0de4fd9643a0bd13a7d017a739a0e92a0f847b0561ea56b9f0c299769735f49471f5c41a77331c12e3a74c19f2378cae527ce3bef8b6e438bcfbf55aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\vvnQSavi.xlsm

Filesize
27KB

MD5
cc26ba122947e6ec8e14fdd4fd3ac68c

SHA1
b926743c9c9cddbc9de83da033cefc216d8b1b65

SHA256
dae668ccd136b4dffa9ca68d10618a36f177831ed2c287e2bc4b4169353f60bf

SHA512
2b2580f2707852d979bea97dfc5a507d23f58307822f33746a32a27a9b35838e01b0cb2c4d5dcb8071137f38e023551b81bcef31a50f5cbfe8aa410990801065

Download Submit
C:\Users\Admin\AppData\Local\Temp\vvnQSavi.xlsm

Filesize
25KB

MD5
845c5f12a88d77c19339c714b8594475

SHA1
4342e9dfda7cc75aee6b833d7e3d70820769dd49

SHA256
a57c1d76e09917eed5b93921df0df9d26fa63619c0f40397372074b339b43d8f

SHA512
6da11803d323cd538137e8235c8e6435c77e3c43e02d7c414b70c957a7c045ee0d0b43877df72f4666348d6c8e68b8134e3f0da40d73a8d51de68cc2267c42e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\~$vvnQSavi.xlsm

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_bb171e79081a821dafa8509ddf343c838968b5e5c598379ec25fdd5e28a34164N.exe

Filesize
221KB

MD5
46b5337e41d74cd950d20116157be4a6

SHA1
a5081dfbd08b173e3c29ebc044a297d300e8fe61

SHA256
ae55581bb635ede226ebe82211b0e137df14de5924d01573bea62ce5976f2fd3

SHA512
3c24ac60e1889fc7676d49a5bb6a329b30ba29dbd2b9d04190f4235877ad3f9e975e697a3bda3c522c17172a035262552c939b8486ebf1a99f851d0754810f75

Download Submit
memory/1640-114-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1640-40-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1816-115-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/1816-117-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/1816-148-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2556-27-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2556-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2572-18-0x000000007329E000-0x000000007329F000-memory.dmp

Filesize
4KB

Download
memory/2572-28-0x0000000000390000-0x00000000003CE000-memory.dmp

Filesize
248KB

Download
memory/3016-39-0x0000000000040000-0x000000000007E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads