xred | c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7a

General

Target

c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe
Size

1.7MB
MD5

be3ef9e44b41f1a9b1ce72af0d791480
SHA1

8a9cc706bf93031e20c97342cf90540f42c53da5
SHA256

c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7a
SHA512

a0c4647cc5a10ed15802578d92dd6553bf8906ef4232407b494735318100e0019453cae6ff2acae05de47306ad6f431c3e9a8dc0bd21b95751c7087d44735be7
SSDEEP

49152:CnsHyjtk2MYC5GDKb6J1oM07EPvUVz4+o73Q79:Cnsmtk2amwEPs0+o73Y

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
2940	._cache_c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe
2244	Synaptics.exe
2748	._cache_Synaptics.exe

Loads dropped DLL 7 IoCs

pid	Process
2364	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe
2364	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe
2364	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe
2364	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe
2244	Synaptics.exe
2244	Synaptics.exe
2244	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2852	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2852	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2940	2364	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe	30
PID 2364 wrote to memory of 2940	2364	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe	30
PID 2364 wrote to memory of 2940	2364	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe	30
PID 2364 wrote to memory of 2940	2364	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe	30
PID 2364 wrote to memory of 2244	2364	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe	31
PID 2364 wrote to memory of 2244	2364	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe	31
PID 2364 wrote to memory of 2244	2364	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe	31
PID 2364 wrote to memory of 2244	2364	c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe	31
PID 2244 wrote to memory of 2748	2244	Synaptics.exe	32
PID 2244 wrote to memory of 2748	2244	Synaptics.exe	32
PID 2244 wrote to memory of 2748	2244	Synaptics.exe	32
PID 2244 wrote to memory of 2748	2244	Synaptics.exe	32

C:\Users\Admin\AppData\Local\Temp\c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe
"C:\Users\Admin\AppData\Local\Temp\c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\._cache_c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2940
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2748

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.7MB

MD5
be3ef9e44b41f1a9b1ce72af0d791480

SHA1
8a9cc706bf93031e20c97342cf90540f42c53da5

SHA256
c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7a

SHA512
a0c4647cc5a10ed15802578d92dd6553bf8906ef4232407b494735318100e0019453cae6ff2acae05de47306ad6f431c3e9a8dc0bd21b95751c7087d44735be7

Download Submit
C:\Users\Admin\AppData\Local\Temp\3kx7EfSz.xlsm

Filesize
25KB

MD5
3d3749705f31cc66528a732acab71a2f

SHA1
00d0edb41da7fda8c2d3d7a755cb24044e9e297e

SHA256
3cab21bab94bacec3a731118a40a713e223a041361eab06fb9319d54a5039f42

SHA512
03b403d91c9e4de7b7607d34c456452fa08a964c554c7c91c5f9c141817e78c253e56baba44381c82f74cc4369e77195262682d82c232f68ad65353cbbd094eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\3kx7EfSz.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3533259084-2542256011-65585152-1000\549b9b645cadfe6bb4bc69cf363c354c_38b42d9b-3e83-45f4-8789-a30be34574b0

Filesize
2KB

MD5
f97f9e17eafdd0105a4e11bafde04b40

SHA1
ba06a7abe986a61b71889b80a6f9b02b22d40667

SHA256
4783424121e6c2f870dc931b374d20c62c764eddc5769d2f536609adc1226abb

SHA512
778c4aab55f6f0fe44dbc9a97f53b59ec8ed2e35901f77afebaea57c738ad301412760709ab909b51335ddd7676cd8f8c1410c5751f2ef5cc74282bcd6c5f50e

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_c57b80dbe7f0a43cc4b5d17205fdc61cb5175c066097f7ad7771c39c92e9df7aN.exe

Filesize
1.0MB

MD5
76410c6e9893303b8e732a1b498f8442

SHA1
1417df7fc4a75179ecf1e6bb349dc289e1d34c64

SHA256
8d35ea3814646a968352f52ccc901a186c512a18682f987124f20c6791325fd0

SHA512
3ea369177e5db5d5acf5504a0782e6e16b2b171ee55f4f54162672a1e90a1f9cdc5b732850aafb6d1dd31cec6937d93dae174b7f4d859e4b86c8f7efd34f5873

Download Submit
memory/2244-91-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/2244-92-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/2244-124-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/2364-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2364-28-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/2852-48-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads