xred | 3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe
Size

4.6MB
MD5

d8734a9286d0a51bc1f0a37ddfc35344
SHA1

75a5954e9762a09d6dfd638907a416b8f2bfb656
SHA256

3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e
SHA512

51c7d06a0cabc7ddbb22400b510c9abb7695de43da20c83bac4efb06f3b4466dce9cd23c87e17649c478e8386116fe1dc0a9af575fe2694104e8f129231919dc
SSDEEP

49152:knsHyjtk2MYC5GDd1GtQfUZ53MQD7typ+VeQWwbM7FDC/5xKyzKC8aJBVE2+ofHZ:knsmtk2aStCtD7tNPKyuC53+2+ofh/wi

Score

10^/10

xred backdoor discovery macro persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x0007000000016d67-109.dat

Executes dropped EXE 3 IoCs

pid	Process
2620	._cache_3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe
2300	Synaptics.exe
2912	._cache_Synaptics.exe

Loads dropped DLL 5 IoCs

pid	Process
2412	3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe
2412	3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe
2412	3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe
2300	Synaptics.exe
2300	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2976	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2976	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2620	2412	3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe	30
PID 2412 wrote to memory of 2620	2412	3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe	30
PID 2412 wrote to memory of 2620	2412	3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe	30
PID 2412 wrote to memory of 2620	2412	3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe	30
PID 2412 wrote to memory of 2300	2412	3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe	31
PID 2412 wrote to memory of 2300	2412	3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe	31
PID 2412 wrote to memory of 2300	2412	3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe	31
PID 2412 wrote to memory of 2300	2412	3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe	31
PID 2300 wrote to memory of 2912	2300	Synaptics.exe	32
PID 2300 wrote to memory of 2912	2300	Synaptics.exe	32
PID 2300 wrote to memory of 2912	2300	Synaptics.exe	32
PID 2300 wrote to memory of 2912	2300	Synaptics.exe	32

C:\Users\Admin\AppData\Local\Temp\3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe
"C:\Users\Admin\AppData\Local\Temp\3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\._cache_3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2620
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2912

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
4.6MB

MD5
d8734a9286d0a51bc1f0a37ddfc35344

SHA1
75a5954e9762a09d6dfd638907a416b8f2bfb656

SHA256
3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e

SHA512
51c7d06a0cabc7ddbb22400b510c9abb7695de43da20c83bac4efb06f3b4466dce9cd23c87e17649c478e8386116fe1dc0a9af575fe2694104e8f129231919dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\hL8GDiwb.xlsm

Filesize
21KB

MD5
f8e2d174e77724ecc257d642dbd3d805

SHA1
901d9d266d6f4bf26de148d76aa6376f445dc205

SHA256
568d773c47357acb55a8a51d983b65f4092b173aa738da89c42dc90f4811ee6e

SHA512
0fc1bf7c3abe3922a3533f24c62fe630b9ced23e23307dd1bf5bcdd89bf29eb3abd01834b17e5dd5193872cc609a6edfb26db7c5d7553e31c5889979781260b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\hL8GDiwb.xlsm

Filesize
25KB

MD5
33b2cf109fb8659fc9f9994a16a386c3

SHA1
ce11558e6d207eaeeaeea4da12be6c1adaff66f3

SHA256
6226bf82818a1637daa67b2fd3efd4d8bcc737e60d2e7adefb5add91f18d6f8f

SHA512
0f7f71c4cdb79450b59a93e95c20c4abf50bf37fbe6e913be9ec550da157618e81bdf1daf048fcc6b1c7ecc7d487686dc6a96cbf1587373ca6f7181c95a5f995

Download Submit
C:\Users\Admin\AppData\Local\Temp\hL8GDiwb.xlsm

Filesize
23KB

MD5
2989e9805afd4df9c56f7f781ce2b22f

SHA1
3fb143d353353a770d3e7832aa915c25ac966105

SHA256
a2cec93151a751fe72d1938f27c5863708b575195e2b163acbc4b25580a56e11

SHA512
3bd25d85e716364245d22ace075ab662e99eb6d12d869fb1db4b33f2df9aebcaf26406b178db4da5517bb07a349b8e6b1a2d2f477a731461e659ebd9df5504d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\hL8GDiwb.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\hL8GDiwb.xlsm

Filesize
21KB

MD5
e05be27d15d1ed8adb01f9b33622d277

SHA1
3bfa206bcfa55e55cc1969197def72ad2939cc64

SHA256
fed8cc8f7f95e0d4c5486f53fab61e6d71dd8dd6d40ae5520a10de4f9757deec

SHA512
02ebcfc3b6cfb6e0c4957f5a8bd28f796f6a7a52daa24aa21b582ed2c44847e14ca8bdee4721f8db2666f9fdc6ebd0c3621bd6cf4ca03a9a8fe6d97e0fe507a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\hL8GDiwb.xlsm

Filesize
26KB

MD5
6f0d84aa67421fa4d6482ebc3767674c

SHA1
bda4dfef0bcb1e225a9fdbf176bb6cdfafba282d

SHA256
d49841fe562dd89532fd2c6d4f6fe5eb20eb4b2e30d4cbc4b55bb6abadd2e237

SHA512
47ffe3793213d8af0fc186622b87fe3af31cc94f33b7ddd8194ccd4ce2b75483e99a0c4d8f244ef70b2a2b3c968847847df407cc37de323fc462f99b6d8753a7

Download Submit
C:\Users\Admin\Desktop\~$OpenBackup.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe

Filesize
3.9MB

MD5
8ccc41b8aff48c2d933603cc6209260a

SHA1
d84f1fef3a8b029cd14d2015ec88f804186d94f8

SHA256
83c2d22f495011f4a4524791c38382b8011803e2e50c274e6d02a510cd6b6baf

SHA512
856c08cb392a09c48306c83ad917f312f1b9ede90aa60253752c4d35d5525301d0c958d6bcb535d4ffcc9faab5638140103a1b7f81f2539b3acc6c9b7bbcafab

Download Submit
memory/2300-126-0x0000000000400000-0x00000000008A4000-memory.dmp

Filesize
4.6MB

Download
memory/2300-158-0x0000000000400000-0x00000000008A4000-memory.dmp

Filesize
4.6MB

Download
memory/2300-125-0x0000000000400000-0x00000000008A4000-memory.dmp

Filesize
4.6MB

Download
memory/2412-0-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2412-25-0x0000000000400000-0x00000000008A4000-memory.dmp

Filesize
4.6MB

Download
memory/2976-37-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2976-124-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads