xred | 9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
Size

4.9MB
MD5

31c87f5d5944f640a038bbac783d2fed
SHA1

d5c315906b21d3282546eb8d575bbd8627e5f2a0
SHA256

9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3
SHA512

86542ffc445909e619a4a1022e327cf657a54ebc1fa5610d283fdf17bab2d7ed3435f2bde60145dba462b5132e60e8edc2a8bff0837f7b4e4a9a086eaa962c38
SSDEEP

98304:8nsmtk2a3qn8jyKfnh00zrt2miokfKA9/iLIkZKIbqY1wu4a:SLx8j790miokb/iLIkAIh

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
1936	._cache_9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
2852	Synaptics.exe
2720	._cache_Synaptics.exe

Loads dropped DLL 5 IoCs

pid	Process
1292	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
1292	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
1292	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
2852	Synaptics.exe
2852	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1292	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
2852	Synaptics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2652	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1292	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
2852	Synaptics.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2652	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1936	1292	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe	30
PID 1292 wrote to memory of 1936	1292	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe	30
PID 1292 wrote to memory of 1936	1292	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe	30
PID 1292 wrote to memory of 1936	1292	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe	30
PID 1292 wrote to memory of 2852	1292	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe	31
PID 1292 wrote to memory of 2852	1292	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe	31
PID 1292 wrote to memory of 2852	1292	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe	31
PID 1292 wrote to memory of 2852	1292	9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe	31
PID 2852 wrote to memory of 2720	2852	Synaptics.exe	32
PID 2852 wrote to memory of 2720	2852	Synaptics.exe	32
PID 2852 wrote to memory of 2720	2852	Synaptics.exe	32
PID 2852 wrote to memory of 2720	2852	Synaptics.exe	32

C:\Users\Admin\AppData\Local\Temp\9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
"C:\Users\Admin\AppData\Local\Temp\9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\Temp\._cache_9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1936
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2720

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
4.9MB

MD5
31c87f5d5944f640a038bbac783d2fed

SHA1
d5c315906b21d3282546eb8d575bbd8627e5f2a0

SHA256
9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3

SHA512
86542ffc445909e619a4a1022e327cf657a54ebc1fa5610d283fdf17bab2d7ed3435f2bde60145dba462b5132e60e8edc2a8bff0837f7b4e4a9a086eaa962c38

Download Submit
C:\Users\Admin\AppData\Local\Temp\qrBCwooF.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\qrBCwooF.xlsm

Filesize
23KB

MD5
09d64c65240fa96ceb0986d06827ff18

SHA1
2560f268d5fbb56ddfa66a6b08af8e7cbe1c75ca

SHA256
6e4380f073852e7a303399e28769b2999082112a64096bc04addd00a6b105090

SHA512
cf00ade68a9c433165b8dcc8e4925d893639f816da96b5f8fe34ff032aa015a59a4aa23585270c0e37606383f7ff4bd92383b6028e8c464fe6cce6ab006ed250

Download Submit
C:\Users\Admin\AppData\Local\Temp\qrBCwooF.xlsm

Filesize
21KB

MD5
757c07c9b1e1f55556e2e9d397d15ae1

SHA1
030afe0b8d8a964bad1c70981f4fdcd1c9747866

SHA256
9435f187668dd526278966c17aa3b64f5b267be773566d5bfd6376068ea36c5a

SHA512
c3ada82113cedb1f8347ac4f4f98aa3e6d8fe4b1c8205a116d49dd0930776c3c9d5147f1ef27510988ad6487d6b7deb4b210a80493866ffc45691e6007217936

Download Submit
C:\Users\Admin\AppData\Local\Temp\qrBCwooF.xlsm

Filesize
25KB

MD5
1331c4273185439cf214aff182f7dc15

SHA1
8c0d8cc4fd9ab9b05a1694f522ee4326bc5033a8

SHA256
7bad34d60f93c1e2284bbd76ec6138b8277ad926540de7962645e468057df31d

SHA512
eda46a19c95ff004191c7c50da7b94c0b63b4fa5a97629d26de7364b64bcfeb3563ff73ad000d80614270eb6b19b079ac1ae70720ffa3f329f10b259cda0536b

Download Submit
C:\Users\Admin\AppData\Local\Temp\qrBCwooF.xlsm

Filesize
21KB

MD5
2e7c2decd45fbe7592e584ca7aaca55f

SHA1
3247e5fc36cdbe673e95868a2215b2f9cbba8386

SHA256
1d2c574450a40bf72edef8bc867d5a537644b447241c6faac767f218536a6ac1

SHA512
e5bacc042b09e114fd93a52feed883a23c3cc4a6e80a2d651410dcbc986e099c77c4be24f4644848b7ca98b518476d8e2e79550a40666cff86e94ea80fa69d5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\qrBCwooF.xlsm

Filesize
26KB

MD5
81efe7a2fe4149e9b71477d936fe2e89

SHA1
9a6d076200a2452d161a440b214e68ce0f31032a

SHA256
e8f922df222fe1647b0392e1e61d7305f7441c7e587e99742ea25d6ad7dac263

SHA512
e6cd5057902efeded915aa01bae2d5703b629f0959af66edbc99072f83a2b14a6f72ebdb0aa9d6193360f360d9cc20eafe3efd02a8d9f59a894f90c4a6fea1d2

Download Submit
C:\Users\Admin\Desktop\~$OpenBackup.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_9c63a1a3812e1c755b84881269d7d6059da72fd665f0aceca990d0b79786f5b3.exe

Filesize
182KB

MD5
aceaf589902c4905f4d163f06cdb3213

SHA1
889e6070de66e63ab00ea1f80233db907475e61e

SHA256
9d6b6119d03a42674ecbda7dd6509b25443605330f7c9e5ce77e4e2e0f5a0d16

SHA512
47ad71b73d4dbf2417828459ccea342a36aa03f08cffeae99de1b4a6698121bce94628bffb49cb749d6547e3ed740b4a2945b4a52f6bb067e6a78bff1b3470cd

Download Submit
memory/1292-8-0x0000000000400000-0x00000000008E6000-memory.dmp

Filesize
4.9MB

Download
memory/1292-38-0x00000000004A5000-0x00000000006CD000-memory.dmp

Filesize
2.2MB

Download
memory/1292-39-0x0000000000400000-0x00000000008E6000-memory.dmp

Filesize
4.9MB

Download
memory/1292-0-0x00000000004A5000-0x00000000006CD000-memory.dmp

Filesize
2.2MB

Download
memory/1292-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1292-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1292-5-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2652-47-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2652-134-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download