xred | b3763fd28aaaed4351ed92096131e9fabd1e00b34b87bb2312efd611ad66a4d4

Analysis

max time kernel
62s
max time network
63s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
03-12-2024 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EMV Reader Writer Software.exe
Size

1.7MB
MD5

b419b88ad4736f6e14fae96431188b78
SHA1

5a805150faca002946601b12fe48d83f569d1003
SHA256

b3763fd28aaaed4351ed92096131e9fabd1e00b34b87bb2312efd611ad66a4d4
SHA512

7a959f1f3ad3c083662c6ab505757b8f8e9de4ec51187ef207bd34c68903dcc649b871ca662ff71ebcf9d176e016e9da5173ff9dbd0ca8824671678bf5bfd974
SSDEEP

24576:QnsJ39LyjbJkQFMhmC+6GD94n+PB8P/H9jXKZP57nP0eWcjGKZplchPT2IXw7ChL:QnsHyjtk2MYC5GDinl2J+6kw7A

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	EMV Reader Writer Software.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	._cache_EMV Reader Writer Software.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	tmp2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	SynTPHelper.exe

Executes dropped EXE 8 IoCs

pid	Process
1944	._cache_EMV Reader Writer Software.exe
3628	Synaptics.exe
236	SynTPHelper.exe
5012	EMV Reader Writer Software V8.exe
1136	tmp1.jpg
4908	tmp2.exe
1500	emv.exe
2632	SynTPHelper.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	EMV Reader Writer Software.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\emv.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\emv.exe"	tmp2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SynTPHelper.exe	SynTPHelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMV Reader Writer Software.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_EMV Reader Writer Software.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMV Reader Writer Software V8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1.jpg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SynTPHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SynTPHelper.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000700000004479e-5.dat	nsis_installer_1
behavioral2/files/0x000700000004479e-5.dat	nsis_installer_2

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	EMV Reader Writer Software.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1500	emv.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1944	1616	EMV Reader Writer Software.exe	80
PID 1616 wrote to memory of 1944	1616	EMV Reader Writer Software.exe	80
PID 1616 wrote to memory of 1944	1616	EMV Reader Writer Software.exe	80
PID 1616 wrote to memory of 3628	1616	EMV Reader Writer Software.exe	81
PID 1616 wrote to memory of 3628	1616	EMV Reader Writer Software.exe	81
PID 1616 wrote to memory of 3628	1616	EMV Reader Writer Software.exe	81
PID 1944 wrote to memory of 236	1944	._cache_EMV Reader Writer Software.exe	82
PID 1944 wrote to memory of 236	1944	._cache_EMV Reader Writer Software.exe	82
PID 1944 wrote to memory of 236	1944	._cache_EMV Reader Writer Software.exe	82
PID 1944 wrote to memory of 5012	1944	._cache_EMV Reader Writer Software.exe	83
PID 1944 wrote to memory of 5012	1944	._cache_EMV Reader Writer Software.exe	83
PID 1944 wrote to memory of 5012	1944	._cache_EMV Reader Writer Software.exe	83
PID 5012 wrote to memory of 2996	5012	EMV Reader Writer Software V8.exe	84
PID 5012 wrote to memory of 2996	5012	EMV Reader Writer Software V8.exe	84
PID 5012 wrote to memory of 2996	5012	EMV Reader Writer Software V8.exe	84
PID 2996 wrote to memory of 1136	2996	cmd.exe	86
PID 2996 wrote to memory of 1136	2996	cmd.exe	86
PID 2996 wrote to memory of 1136	2996	cmd.exe	86
PID 5012 wrote to memory of 5088	5012	EMV Reader Writer Software V8.exe	87
PID 5012 wrote to memory of 5088	5012	EMV Reader Writer Software V8.exe	87
PID 5012 wrote to memory of 5088	5012	EMV Reader Writer Software V8.exe	87
PID 5088 wrote to memory of 4908	5088	cmd.exe	89
PID 5088 wrote to memory of 4908	5088	cmd.exe	89
PID 4908 wrote to memory of 1500	4908	tmp2.exe	90
PID 4908 wrote to memory of 1500	4908	tmp2.exe	90
PID 236 wrote to memory of 2632	236	SynTPHelper.exe	99
PID 236 wrote to memory of 2632	236	SynTPHelper.exe	99
PID 236 wrote to memory of 2632	236	SynTPHelper.exe	99

C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software.exe
"C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\._cache_EMV Reader Writer Software.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_EMV Reader Writer Software.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:236
  - - C:\Windows\SynTPHelper.exe
      "C:\Windows\SynTPHelper.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2632
- - C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe
    "C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start %temp%\tmp1.jpg
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        
        C:\Users\Admin\AppData\Local\Temp\tmp1.jpg
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start %temp%\tmp2.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Drpbx\emv.exe
        
        "C:\Users\Admin\AppData\Local\Drpbx\emv.exe" C:\Users\Admin\AppData\Local\Temp\tmp2.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        
        PID:1500
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
753KB

MD5
577dba6b43851a764ee9acf927a022bd

SHA1
1d0dc5d99138439bc7f1b043e958481469233ae3

SHA256
c37feb65445e006204fd539ae455bd343fee3721a1f4ac599a2fc1d0a523e807

SHA512
cab93a09699d71997dc49ffa38898bfeeebaf97b795de1915a6e6a23a3db06c68555a1f9fd712387cc230bb736e99113e0047298fc9ffb1b2a7654d4301b8c4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SynTPHelper.exe.log

Filesize
319B

MD5
6dffe4ca730ff070c448bf2b67bc0641

SHA1
09118ae384c45c1b0c020fa22916ae43f7f08732

SHA256
fc164b3c1c1af6b1bf881fcab858b269a85310b0a4f3cefb0a91431e00950a23

SHA512
82f6db85157f79f832c8aab985f8a959afc7a8fad9bd82a4a8a23a8d97a1d563ed6659603cdcdbb0b8c125e56ee37acde9a423f14f6dee2df99a3d2a25649037

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_EMV Reader Writer Software.exe

Filesize
942KB

MD5
35d2469a266ad4cf08ee723ca74b843d

SHA1
979527e8c77baab1d5d42d290c482a03543b2ea3

SHA256
9a696e11bcdd0d59577c43613d983daad607ea2fe0b2562f9359c23643cda18b

SHA512
f884e24ee775c64d42e2c914e27403c31087e13bccb9c89eb4814c1eca91d84744640f9e112851a12ea4a907b2d210f9c81b372ce7bd04a97037876ff701509a

Download Submit
C:\Users\Admin\AppData\Local\Temp\EMV Reader Writer Software V8.exe

Filesize
560KB

MD5
a03920ec643f26a5d38676c953e6f4f6

SHA1
3756009fafeb360bc7f4b95654d027326688b8f0

SHA256
a1de7bc1d00660b7416e91442bcb89dcb8a05351eb22f03f89258d9077e69a80

SHA512
c472251c1a2e76100a6065d8e2b5fc42b5cf1fd85d4e31850b0f12806afb8e8b3c86f63c7ac2bee3f0a3add77412f03192f8c9fc494dc12e74295c7083f61156

Download Submit
C:\Users\Admin\AppData\Local\Temp\SynTPHelper.exe

Filesize
1.5MB

MD5
00291c15181baa184b62938cb519ba4c

SHA1
0691b2e7177466adf594352e27ebdfcd0d7aee90

SHA256
c4820b44454f5072937047af8fa53cabe7e21d3fdf0464581a70594b9f2a7f73

SHA512
f20a5d68b02f88fd94486e3158bf68af338eb6080b4aa75514c556cbbd3dda3044fc1bce1b5c3e37de8bb61277f60b0069a1480d8fd6412f4e020b0c3463cb80

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1.jpg

Filesize
118KB

MD5
c9a3ccf95369f53cd448fac94ff4e3b8

SHA1
48131cd75821aad01ace71277206b7c6d7d4925c

SHA256
dc32698c13de42e87913c6d90939186a56ca4586e0397df52ed85e47443ceef4

SHA512
eeec3a8dd76cee4a1d774f7f34766742c6b92d833f8a92adb251cb618924935d3fbaf5c386b7c5291489ad805d3233dfd8b41aaafd73851aa9b410b45ff86e3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2.exe

Filesize
13KB

MD5
913157f29b94106f5b6db18d04eb3c41

SHA1
c0e08c5557e38f4705c4c614586de7becdfeafaa

SHA256
cc4cd74a7db7edd8a16da7ff6fccf491bf61cc19ac73aae5843c56821d09272f

SHA512
4f075ffea2887f5db4cd80c15736740afbee81f3b9148b7cc458bc36095daa59555767d4481668c6e9b91881dcf0107c36b495dde5d3ecce99aaf4cb490a413b

Download Submit
memory/1136-139-0x0000000005200000-0x00000000057A6000-memory.dmp

Filesize
5.6MB

Download
memory/1136-133-0x00000000002A0000-0x00000000002C6000-memory.dmp

Filesize
152KB

Download
memory/1136-144-0x0000000004DA0000-0x0000000004DF6000-memory.dmp

Filesize
344KB

Download
memory/1136-138-0x0000000004BB0000-0x0000000004C4C000-memory.dmp

Filesize
624KB

Download
memory/1136-143-0x0000000004B60000-0x0000000004B6A000-memory.dmp

Filesize
40KB

Download
memory/1136-140-0x0000000004C50000-0x0000000004CE2000-memory.dmp

Filesize
584KB

Download
memory/1500-147-0x0000000000A00000-0x0000000000A08000-memory.dmp

Filesize
32KB

Download
memory/1616-103-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/1616-0-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/3628-108-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/3628-157-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/3628-149-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/3628-148-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4908-142-0x000000001BEF0000-0x000000001BF8C000-memory.dmp

Filesize
624KB

Download
memory/4908-141-0x000000001C4C0000-0x000000001C98E000-memory.dmp

Filesize
4.8MB

Download
memory/5012-137-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads