xred | 63cf9f5d8fcdb4bc57c17b35b34f0a1edf92d42e4c2ff621a966c7a3cf2b1270

Analysis

max time kernel
142s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe
Size

4.0MB
MD5

fe812223b4ec65e09362ec90e98aeb66
SHA1

d63efd92ba34528df23c4666290ccc9b88bb4cc7
SHA256

63cf9f5d8fcdb4bc57c17b35b34f0a1edf92d42e4c2ff621a966c7a3cf2b1270
SHA512

13ce97105ccf6fbf8cfafdac0a9027fb60d1d68e9d09953849e7e2401f3df6ff5600b53ddcb4d88af29c0fd1cd24bb80ad6ea951fda8fa8b81c912d3e9aaa87e
SSDEEP

98304:+nsmtk2aqqanA7Q5RmbBNW9BMhnu5Puhyi1cZ+1KWDQ:ALPBAE/mwqNu5mUit1M

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exeSynaptics.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 3 IoCs

Processes:

._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exeSynaptics.exe._cache_Synaptics.exe

pid	Process
4304	._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe
4996	Synaptics.exe
920	._cache_Synaptics.exe

Loads dropped DLL 8 IoCs

Processes:

._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe._cache_Synaptics.exe

pid	Process
4304	._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe
4304	._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe
4304	._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe
4304	._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe
920	._cache_Synaptics.exe
920	._cache_Synaptics.exe
920	._cache_Synaptics.exe
920	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exeSynaptics.exe._cache_Synaptics.exe2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 2 IoCs

Processes:

2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exeSynaptics.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid	Process
1200	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exeEXCEL.EXE._cache_Synaptics.exe

pid	Process
4304	._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe
1200	EXCEL.EXE
1200	EXCEL.EXE
920	._cache_Synaptics.exe
1200	EXCEL.EXE
1200	EXCEL.EXE
1200	EXCEL.EXE
1200	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exeSynaptics.exe

description	pid	Process	procid_target
PID 692 wrote to memory of 4304	692	2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe	82
PID 692 wrote to memory of 4304	692	2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe	82
PID 692 wrote to memory of 4304	692	2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe	82
PID 692 wrote to memory of 4996	692	2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe	83
PID 692 wrote to memory of 4996	692	2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe	83
PID 692 wrote to memory of 4996	692	2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe	83
PID 4996 wrote to memory of 920	4996	Synaptics.exe	84
PID 4996 wrote to memory of 920	4996	Synaptics.exe	84
PID 4996 wrote to memory of 920	4996	Synaptics.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:692
- C:\Users\Admin\AppData\Local\Temp\._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4304
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:920

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
4.0MB

MD5
fe812223b4ec65e09362ec90e98aeb66

SHA1
d63efd92ba34528df23c4666290ccc9b88bb4cc7

SHA256
63cf9f5d8fcdb4bc57c17b35b34f0a1edf92d42e4c2ff621a966c7a3cf2b1270

SHA512
13ce97105ccf6fbf8cfafdac0a9027fb60d1d68e9d09953849e7e2401f3df6ff5600b53ddcb4d88af29c0fd1cd24bb80ad6ea951fda8fa8b81c912d3e9aaa87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_2024-12-03_fe812223b4ec65e09362ec90e98aeb66_darkgate_magniber.exe

Filesize
3.3MB

MD5
f0e5feb33456e9d07be9cd6c475076ba

SHA1
69e24ec64e8825b9f639a417aaadf6386087b61a

SHA256
2f009ce8426068f39eaa5c8df77d340f40090d422a6ab5fdfd0f5416c2f62a41

SHA512
16b7b933dcb1d6c7f033601808ff0367810dd86f6f3aad03d0739f42845e5755643aed3837866420adbb17db0ed20b1c9006ea4847cead9f3ad08d75705d6eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\93975E00

Filesize
27KB

MD5
022e126826fee370fbfbcb76fef7560f

SHA1
9e62b39aeb2a756b271907ed56ef927ae75a5c65

SHA256
885c5505fe0f4387a0e283b08ef8b2df3e23660c30a1b331ada0cf2045d4ddc6

SHA512
3d26037489c61d504fd3222043862ea0b56063b324e4f2ff1f57e0ac1d11f9256b44e3c6e8a524ec54d3e7f77c90029715a204fa3d7b2dd13ddc5f30828dc665

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb83F5.tmp

Filesize
1KB

MD5
4037c9318188e436b6af7849ab31a68d

SHA1
b8b35ef3c83445a18a662c465cda819e7ccc60ab

SHA256
90797b59cf4ba7f60f63ca0c101766bcebe0af08ddf4c4708a49b24a8c0fb89e

SHA512
e2bd992daa146f9bf39a2f8136181254782e58b9fd28291b122600c1535941bf76c1ffb438e4c3cccab32d58a8ce5e98f457da8206c716c4bde1f56e3d384aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb8444.tmp

Filesize
1KB

MD5
bb52da2afef96834a101a86f99c9eea2

SHA1
bc0a5987024339989202c13c2dd334d654ab3387

SHA256
9df6e8f19d890b7ad50b4625aba5af7da4bff84c58e3a3de51b450e637b84147

SHA512
75558e179da51cf392ea00aa64cd7039567f9848b87cf8d4c6a229141ff42412f1c7872ec6d0656481d620da4e218e463847c1e6a231ab52c90dc7623398938c

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb84C2.tmp

Filesize
1KB

MD5
2a86ef34f315258839e59e5a0a079b6a

SHA1
97ea29a432a89df2d6fff9bf27d30ca04f9fd271

SHA256
3c0430dc9095a538f84135106131cbe2ac1618c4851c9d05eddd2c1115789928

SHA512
cad25b8be59cf8c7245b65e7dfae784ad1d5a16ebab3b77fceac346647915ffff25408b8e62c54a0aab578c9e232aaad9f7aadb1ecbe415874f0df77721e6f4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb84F2.tmp

Filesize
1KB

MD5
6a25e341d40f91b87b11f447d2e4237a

SHA1
88194bcef787bbf2acca55405d8cfcb21ac2dcb7

SHA256
a529d3162289366a251bbebe05adb25f6db925896e54aebf956763133a3d460d

SHA512
a0a0be4b82918822b69e33c3dbb39c4f908d605aeb3a8857cb1fbee014adca4d0414b04e101f7c06209639b22443c50549d728778b00ee38ecccfc2485b907ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\rNbDawED.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
memory/692-131-0x0000000000400000-0x0000000000806000-memory.dmp

Filesize
4.0MB

Download
memory/692-0-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/920-268-0x0000000002BD0000-0x0000000002CE2000-memory.dmp

Filesize
1.1MB

Download
memory/920-360-0x0000000002BD0000-0x0000000002CE2000-memory.dmp

Filesize
1.1MB

Download
memory/920-354-0x0000000000680000-0x00000000006C6000-memory.dmp

Filesize
280KB

Download
memory/920-352-0x0000000010000000-0x00000000100DC000-memory.dmp

Filesize
880KB

Download
memory/920-280-0x0000000002CF0000-0x0000000002D49000-memory.dmp

Filesize
356KB

Download
memory/920-346-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/920-283-0x0000000002CF0000-0x0000000002D49000-memory.dmp

Filesize
356KB

Download
memory/920-273-0x0000000002BD0000-0x0000000002CE2000-memory.dmp

Filesize
1.1MB

Download
memory/920-258-0x0000000000680000-0x00000000006C6000-memory.dmp

Filesize
280KB

Download
memory/920-236-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/920-251-0x0000000010000000-0x00000000100DC000-memory.dmp

Filesize
880KB

Download
memory/920-361-0x0000000002CF0000-0x0000000002D49000-memory.dmp

Filesize
356KB

Download
memory/1200-238-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

Filesize
64KB

Download
memory/1200-342-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

Filesize
64KB

Download
memory/1200-243-0x00007FFD314F0000-0x00007FFD31500000-memory.dmp

Filesize
64KB

Download
memory/1200-240-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

Filesize
64KB

Download
memory/1200-244-0x00007FFD314F0000-0x00007FFD31500000-memory.dmp

Filesize
64KB

Download
memory/1200-241-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

Filesize
64KB

Download
memory/1200-242-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

Filesize
64KB

Download
memory/1200-339-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

Filesize
64KB

Download
memory/1200-239-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

Filesize
64KB

Download
memory/1200-340-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

Filesize
64KB

Download
memory/1200-341-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

Filesize
64KB

Download
memory/4304-145-0x00000000026B0000-0x00000000026F6000-memory.dmp

Filesize
280KB

Download
memory/4304-139-0x0000000010000000-0x00000000100DC000-memory.dmp

Filesize
880KB

Download
memory/4304-166-0x0000000002E00000-0x0000000002E59000-memory.dmp

Filesize
356KB

Download
memory/4304-272-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/4304-169-0x0000000002E00000-0x0000000002E59000-memory.dmp

Filesize
356KB

Download
memory/4304-172-0x0000000002BE0000-0x0000000002CF2000-memory.dmp

Filesize
1.1MB

Download
memory/4304-173-0x0000000002E00000-0x0000000002E59000-memory.dmp

Filesize
356KB

Download
memory/4304-331-0x0000000010000000-0x00000000100DC000-memory.dmp

Filesize
880KB

Download
memory/4304-155-0x0000000002BE0000-0x0000000002CF2000-memory.dmp

Filesize
1.1MB

Download
memory/4304-159-0x0000000002BE0000-0x0000000002CF2000-memory.dmp

Filesize
1.1MB

Download
memory/4304-132-0x0000000002750000-0x0000000002828000-memory.dmp

Filesize
864KB

Download
memory/4304-148-0x00000000026B0000-0x00000000026F6000-memory.dmp

Filesize
280KB

Download
memory/4304-343-0x00000000026B0000-0x00000000026F6000-memory.dmp

Filesize
280KB

Download
memory/4304-345-0x0000000002E00000-0x0000000002E59000-memory.dmp

Filesize
356KB

Download
memory/4304-344-0x0000000002BE0000-0x0000000002CF2000-memory.dmp

Filesize
1.1MB

Download
memory/4304-151-0x00000000026B0000-0x00000000026F6000-memory.dmp

Filesize
280KB

Download
memory/4304-136-0x0000000010000000-0x00000000100DC000-memory.dmp

Filesize
880KB

Download
memory/4304-119-0x00000000779D2000-0x00000000779D3000-memory.dmp

Filesize
4KB

Download
memory/4304-120-0x00000000779D3000-0x00000000779D4000-memory.dmp

Filesize
4KB

Download
memory/4304-70-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download