xred | 7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714

General

Target

7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe
Size

878KB
MD5

7082651a665e7a31c20c1b3463b8a700
SHA1

bf4adfd2ca0bb38fb981ffcc5c9084cf9da92882
SHA256

7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714
SHA512

9e618e294a18d564c1a4fabe4e717894bbeb20e87b4dbc7760e9c40e13fa5d195662df6861d8a9a09d5eb3fa89d0e8b06eba659a51dff352e7231a9c30e6dd32
SSDEEP

12288:AMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9qmwDZzpM:AnsJ39LyjbJkQFMhmC+6GD9+Zza

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
2696	._cache_7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe
2692	Synaptics.exe
484	._cache_Synaptics.exe

Loads dropped DLL 17 IoCs

pid	Process
2824	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe
2824	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe
2824	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe
2824	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe
2468	WerFault.exe
2468	WerFault.exe
2468	WerFault.exe
2468	WerFault.exe
2692	Synaptics.exe
2692	Synaptics.exe
2692	Synaptics.exe
2468	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe
2964	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2468	2696	WerFault.exe	30
2964	484	WerFault.exe	33

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2936	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2936	EXCEL.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2696	2824	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe	30
PID 2824 wrote to memory of 2696	2824	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe	30
PID 2824 wrote to memory of 2696	2824	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe	30
PID 2824 wrote to memory of 2696	2824	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe	30
PID 2824 wrote to memory of 2692	2824	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe	31
PID 2824 wrote to memory of 2692	2824	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe	31
PID 2824 wrote to memory of 2692	2824	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe	31
PID 2824 wrote to memory of 2692	2824	7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe	31
PID 2696 wrote to memory of 2468	2696	._cache_7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe	32
PID 2696 wrote to memory of 2468	2696	._cache_7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe	32
PID 2696 wrote to memory of 2468	2696	._cache_7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe	32
PID 2696 wrote to memory of 2468	2696	._cache_7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe	32
PID 2692 wrote to memory of 484	2692	Synaptics.exe	33
PID 2692 wrote to memory of 484	2692	Synaptics.exe	33
PID 2692 wrote to memory of 484	2692	Synaptics.exe	33
PID 2692 wrote to memory of 484	2692	Synaptics.exe	33
PID 484 wrote to memory of 2964	484	._cache_Synaptics.exe	34
PID 484 wrote to memory of 2964	484	._cache_Synaptics.exe	34
PID 484 wrote to memory of 2964	484	._cache_Synaptics.exe	34
PID 484 wrote to memory of 2964	484	._cache_Synaptics.exe	34

C:\Users\Admin\AppData\Local\Temp\7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe
"C:\Users\Admin\AppData\Local\Temp\7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Local\Temp\._cache_7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 532
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2468
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 532
      4⤵
      Loads dropped DLL
      Program crash
      PID:2964

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
878KB

MD5
7082651a665e7a31c20c1b3463b8a700

SHA1
bf4adfd2ca0bb38fb981ffcc5c9084cf9da92882

SHA256
7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714

SHA512
9e618e294a18d564c1a4fabe4e717894bbeb20e87b4dbc7760e9c40e13fa5d195662df6861d8a9a09d5eb3fa89d0e8b06eba659a51dff352e7231a9c30e6dd32

Download Submit
C:\Users\Admin\AppData\Local\Temp\BcW17lvh.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\BcW17lvh.xlsm

Filesize
20KB

MD5
808e0509c20ca06bfde1821f2c4ae9fc

SHA1
2ca31d8ae3e4c6c9ec6ddf071a21a9ce04a9ddfd

SHA256
5394a970712afa37e82c1fca134c3f285f0d4a92c3de71725f5a9acaf81b923e

SHA512
fd78febae5f22466f8d1ef9461c3230d1bb1ef1f1647f7cfed80e92a575612dee4620c12c2fda8148e686ed8d7a55e2842abc5c08d8e107dd351c63e1257af0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\BcW17lvh.xlsm

Filesize
22KB

MD5
16cfb0c6b8f42545bdd29f6ece77cb09

SHA1
f724505890a5ea1a9982ecfb8b7cacb0dbd48026

SHA256
69ed603acadfe6f93698df7122811c24b86db2667913e3c52df672444bea594e

SHA512
6bc1697ddc033e82bc227c5d394d19e143f68ff8d7861bb5d2b499cabf4dfe02a423512bccdb3aca746a509ff85696806f40a8c8f852f908a61a57afb48da51e

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_7ba203cf0e02705516ecb9640a6ec56e1af722c2cdf0ef396a55002b478d6714N.exe

Filesize
124KB

MD5
dbd2a489c1f5eb8b8a11132aa31d9346

SHA1
fe7578c434bbaac60354293bf9aa82119bba9c3e

SHA256
88a121b4247bd47a384846467943461e2527c16d21923fbf4398ba1b0dfe824c

SHA512
b839ed9196191b66428551896ec8d3291c379583ca655226766bf05c5c9bb58f6d924a4f0ec41d77a291538df25cb1e26f728091c9614e3efa309b08284b9ab3

Download Submit
memory/484-49-0x0000000001030000-0x0000000001054000-memory.dmp

Filesize
144KB

Download
memory/2692-56-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2692-112-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2692-113-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2692-147-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2696-57-0x0000000073FBE000-0x0000000073FBF000-memory.dmp

Filesize
4KB

Download
memory/2696-33-0x0000000001240000-0x0000000001264000-memory.dmp

Filesize
144KB

Download
memory/2696-21-0x0000000073FBE000-0x0000000073FBF000-memory.dmp

Filesize
4KB

Download
memory/2824-0-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2824-30-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2936-58-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads