xred | f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9fe

General

Target

f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe
Size

865KB
MD5

746534ad1d3af34ecd3a2279cde161e0
SHA1

5acd72114fe803d79a7399ed9c4d8f4c991651f1
SHA256

f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9fe
SHA512

4d3c0aa14b93f11f352e3996b1fc29bd18679f2ad5114bbca7a94d9369ddf918c4278587bd784e082661f3a0098150576912e5aafe236b86b197344ec9389cb1
SSDEEP

12288:JMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V92qNj:JnsJ39LyjbJkQFMhmC+6GD9j

Score

10^/10

xred backdoor discovery macro persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x000a000000017355-101.dat

Executes dropped EXE 3 IoCs

pid	Process
2916	._cache_f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe
2764	Synaptics.exe
2440	._cache_Synaptics.exe

Loads dropped DLL 7 IoCs

pid	Process
2348	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe
2348	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe
2348	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe
2348	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe
2764	Synaptics.exe
2764	Synaptics.exe
2764	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
536	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
536	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2916	2348	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe	31
PID 2348 wrote to memory of 2916	2348	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe	31
PID 2348 wrote to memory of 2916	2348	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe	31
PID 2348 wrote to memory of 2916	2348	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe	31
PID 2348 wrote to memory of 2764	2348	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe	32
PID 2348 wrote to memory of 2764	2348	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe	32
PID 2348 wrote to memory of 2764	2348	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe	32
PID 2348 wrote to memory of 2764	2348	f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe	32
PID 2764 wrote to memory of 2440	2764	Synaptics.exe	33
PID 2764 wrote to memory of 2440	2764	Synaptics.exe	33
PID 2764 wrote to memory of 2440	2764	Synaptics.exe	33
PID 2764 wrote to memory of 2440	2764	Synaptics.exe	33

C:\Users\Admin\AppData\Local\Temp\f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe
"C:\Users\Admin\AppData\Local\Temp\f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\._cache_f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe"
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    PID:2440

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
865KB

MD5
746534ad1d3af34ecd3a2279cde161e0

SHA1
5acd72114fe803d79a7399ed9c4d8f4c991651f1

SHA256
f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9fe

SHA512
4d3c0aa14b93f11f352e3996b1fc29bd18679f2ad5114bbca7a94d9369ddf918c4278587bd784e082661f3a0098150576912e5aafe236b86b197344ec9389cb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_f2e8dc7939e6b5542a59086edd6a9a3dd07fa2771e34a32278d161f37461b9feN.exe

Filesize
111KB

MD5
088582ea6aa6c08125ffeca62fd2d997

SHA1
8b6b97bcb79ddb5b018dac5a9043f5e7e284af26

SHA256
278baca497ae9ae362fcf39f27ffb55877ef8da8d25579f72bc045147fe0f34d

SHA512
fa7433d2a8b7f49b6d669077e5e96d1cee512bceed507934255716b7558d3b5bf469eaf5ce72a4ae9f678b9721bee710832096af283a2eeb01798564b258dcc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZJtTshTN.xlsm

Filesize
29KB

MD5
f263cc69e41cfcc7839d092eb5a59a75

SHA1
bfaa15778265d2e2e4f562e2548ef5805eca0373

SHA256
ce17dca486d0db63ca15bc4c033e2f7db2b9f2b8efba756599f11cae5bb34390

SHA512
ff0784256d9bdd9f6577a338f88d40aa0b57600f884a9c7d857eca2c61d85456cd120f23023becc02a1062f40b4deee56da99b54807cbc2e920c38ced249e12e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZJtTshTN.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZJtTshTN.xlsm

Filesize
24KB

MD5
d0bf68bd2ba9d6f7d886e5dcfa8050a1

SHA1
d722afdcf49186bea4dff132ab6a201f292eb8ec

SHA256
0aa72232816174d5c85fc24dbd3990984e186f7dd8a54fc044b329e32e83b2cf

SHA512
e464ede86bd8981fed2d806708dd81417b5954c03d267e57d31823b10a50def69b46fdb7847c75d9e97c1b1100a811583699c75dce1d2a62dd95a7e5841e21a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZJtTshTN.xlsm

Filesize
26KB

MD5
c3759c281121187298799c9e8fb1a12e

SHA1
9c4d9f86c9838218a5cba6670a4dce04d2de2a98

SHA256
5bf0a493382282b47fd227f5cce60b3a4f9e7143f3c1ec8a20ff2f81e2205a09

SHA512
e216487699121bc29c901cc86ba46a2428dfc422bda23b87d39cec4ae5d1d0c0639e50baeb7d830e0a7354e2e6b6dd67d3170284d645fcff893558e0e4a11b4c

Download Submit
memory/536-42-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2348-28-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2348-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2764-41-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2764-109-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2764-110-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2764-142-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads