Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    10-12-2024 04:31

General

  • Target

    Loader.exe

  • Size

    2.6MB

  • MD5

    9312f8185610b599fbab610623562c65

  • SHA1

    284595f0151a56537c5a02e708b072c43123ab30

  • SHA256

    251b00319baa0ea6716fef69f337f1bfbb2697b682d7094c0429e5004b11502b

  • SHA512

    cbf640cffb541c128383ecc4a31bcaae6d2ddd6bd20daa5f8c92791281523802497a5e69756c8041e67d4524a9e66fce8f6e6b8810689d6078e93a16dbb6baaa

  • SSDEEP

    49152:InsHyjtk2MYC5GDECG4hRrwCG4hdrHITYbNbNWo4kSH3OqtwIjkqXfd+/9AhD:Insmtk2aZCG4hRECG4hdLIT4bNJFY3OM

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Users\Admin\AppData\Local\Temp\._cache_Loader.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Loader.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      PID:1472
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2172
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2344
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    2.6MB

    MD5

    9312f8185610b599fbab610623562c65

    SHA1

    284595f0151a56537c5a02e708b072c43123ab30

    SHA256

    251b00319baa0ea6716fef69f337f1bfbb2697b682d7094c0429e5004b11502b

    SHA512

    cbf640cffb541c128383ecc4a31bcaae6d2ddd6bd20daa5f8c92791281523802497a5e69756c8041e67d4524a9e66fce8f6e6b8810689d6078e93a16dbb6baaa

  • C:\Users\Admin\AppData\Local\Temp\ZjIJzYF2.xlsm

    Filesize

    23KB

    MD5

    8107554aa2687d9a5d9a7f3f9336f88f

    SHA1

    505a7bee4db05f4fbd49d103d574cde577fcb5ce

    SHA256

    f9b63041e166846fd66d06dfe59daf8ea8a498fb1b1c4b3800113231bf1d8bf7

    SHA512

    f19f72702e6722d58defcef778255052cc08a96b45a459295ef3344ce9a1297094fe3d24d3dd74e292bc83692cb8b38a1887eba37adf5832814c9c9a687ae650

  • C:\Users\Admin\AppData\Local\Temp\ZjIJzYF2.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • \Users\Admin\AppData\Local\Temp\._cache_Loader.exe

    Filesize

    1.9MB

    MD5

    642be5ba47f59f56b1e8409b54ae78ca

    SHA1

    37fb49ce8927d9cf46afbe15ec67bc0ac0833376

    SHA256

    ab549bf47c08184f8ab98f8df682c394048771096ad5d436ddd950e550517a2c

    SHA512

    2da1440d6e30b31b975460a16727841a681c970d05a80e4fc30b616b1e53e511898720fb3e148a0cd9a6ba4b1b8ba28a68dc601621f4898c6dd572ce7a81e096

  • memory/1472-83-0x00000000074B0000-0x0000000007562000-memory.dmp

    Filesize

    712KB

  • memory/1472-29-0x0000000001380000-0x0000000001566000-memory.dmp

    Filesize

    1.9MB

  • memory/1944-26-0x0000000000400000-0x00000000006A2000-memory.dmp

    Filesize

    2.6MB

  • memory/1944-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2172-86-0x0000000000400000-0x00000000006A2000-memory.dmp

    Filesize

    2.6MB

  • memory/2172-87-0x0000000000400000-0x00000000006A2000-memory.dmp

    Filesize

    2.6MB

  • memory/2172-119-0x0000000000400000-0x00000000006A2000-memory.dmp

    Filesize

    2.6MB

  • memory/2344-42-0x0000000005090000-0x00000000052A4000-memory.dmp

    Filesize

    2.1MB

  • memory/2344-38-0x0000000000F00000-0x00000000010E6000-memory.dmp

    Filesize

    1.9MB

  • memory/2824-39-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB