xred | 21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543

Analysis

max time kernel
111s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe
Size

1.1MB
MD5

65fe41a424c04ecb1dd22b43e7ec5dc0
SHA1

7cb9fe2280a297649c69d4d5ce82ce2b63bfa4b3
SHA256

21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543
SHA512

22093e4ae7ac7559560e96aa2bc63d267433c512f1a87ad6668c81985dc35d35201dcac8ef5839aee0c090870211283ea7847ff2f48a7fe5ac7756f40c629c33
SSDEEP

24576:onsJ39LyjbJkQFMhmC+6GD9dTbBv5rUDyLyL5nKU:onsHyjtk2MYC5GDlB/LyVH

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
2488	._cache_21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe
1912	Synaptics.exe
2716	._cache_Synaptics.exe

Loads dropped DLL 5 IoCs

pid	Process
1636	21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe
1636	21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe
1636	21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe
1912	Synaptics.exe
1912	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2576	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2576	EXCEL.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2488	1636	21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe	31
PID 1636 wrote to memory of 2488	1636	21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe	31
PID 1636 wrote to memory of 2488	1636	21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe	31
PID 1636 wrote to memory of 2488	1636	21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe	31
PID 1636 wrote to memory of 1912	1636	21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe	32
PID 1636 wrote to memory of 1912	1636	21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe	32
PID 1636 wrote to memory of 1912	1636	21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe	32
PID 1636 wrote to memory of 1912	1636	21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe	32
PID 2488 wrote to memory of 2792	2488	._cache_21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe	33
PID 2488 wrote to memory of 2792	2488	._cache_21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe	33
PID 2488 wrote to memory of 2792	2488	._cache_21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe	33
PID 2488 wrote to memory of 2792	2488	._cache_21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe	33
PID 2792 wrote to memory of 2680	2792	cmd.exe	35
PID 2792 wrote to memory of 2680	2792	cmd.exe	35
PID 2792 wrote to memory of 2680	2792	cmd.exe	35
PID 2792 wrote to memory of 2680	2792	cmd.exe	35
PID 1912 wrote to memory of 2716	1912	Synaptics.exe	36
PID 1912 wrote to memory of 2716	1912	Synaptics.exe	36
PID 1912 wrote to memory of 2716	1912	Synaptics.exe	36
PID 1912 wrote to memory of 2716	1912	Synaptics.exe	36
PID 2792 wrote to memory of 2276	2792	cmd.exe	38
PID 2792 wrote to memory of 2276	2792	cmd.exe	38
PID 2792 wrote to memory of 2276	2792	cmd.exe	38
PID 2792 wrote to memory of 2276	2792	cmd.exe	38
PID 2716 wrote to memory of 1860	2716	._cache_Synaptics.exe	39
PID 2716 wrote to memory of 1860	2716	._cache_Synaptics.exe	39
PID 2716 wrote to memory of 1860	2716	._cache_Synaptics.exe	39
PID 2716 wrote to memory of 1860	2716	._cache_Synaptics.exe	39

C:\Users\Admin\AppData\Local\Temp\21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe
"C:\Users\Admin\AppData\Local\Temp\21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\._cache_21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\Create_Shortcut.cmd" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\SysWOW64\cscript.exe
      cscript /nologo "C:\Users\Admin\AppData\Local\Temp\8967-222-17827-27236.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2680
  - - C:\Windows\SysWOW64\cscript.exe
      cscript /nologo "C:\Users\Admin\AppData\Local\Temp\14626-4949-31011-21369.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2276
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\Create_Shortcut.cmd" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1860

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.1MB

MD5
65fe41a424c04ecb1dd22b43e7ec5dc0

SHA1
7cb9fe2280a297649c69d4d5ce82ce2b63bfa4b3

SHA256
21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543

SHA512
22093e4ae7ac7559560e96aa2bc63d267433c512f1a87ad6668c81985dc35d35201dcac8ef5839aee0c090870211283ea7847ff2f48a7fe5ac7756f40c629c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\14626-4949-31011-21369.vbs

Filesize
278B

MD5
0866f21284ab15d4e991f0783080e889

SHA1
4e88caf2da70ae6207c7fb76f86d975752132732

SHA256
23d9130a4e2163c161c353e70dc633a844c0f264ca29784ab1682ed314323d15

SHA512
0255eeef24b6e501e4be4daa82e6354691747c2a9038f7e662de53fa400313a7956d5881936d4f2c7b89eab78937895b5cc8f24ce82d6bb8776aa1636223cbaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\8967-222-17827-27236.vbs

Filesize
266B

MD5
cee6771ae297e6f20fb96ab86eb80eee

SHA1
a05e2600757f022696d617259be6e8c6146e6cef

SHA256
aa8fe20a3bd0855dd1d79838132bdffaa7749b2e4316d84fbdce77b30717d518

SHA512
8ec846f9d5c49d437570d7ed7ef901b8daa37f63597a017c0c292cdf85563605847b541b09ebcff8ec4610d74902e0f678cab169eb8d9fbb9f55d488aac53c16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Create_Shortcut.cmd

Filesize
1KB

MD5
60993d0edbab77c9b3636a7789b52a58

SHA1
2dd951846df7cfedd1af0cf1521bc6298699db22

SHA256
806ef21d06c03622c60b9fd1dd100c69543cce57a6d4846711ecca6c882d21c3

SHA512
c445f45938aef767d8942171b5a12582855650e0dc9099532c94e0b4c59408d2ee98f4d9643f8f58e61b00c85d87c0b4c03f5126a2145285bc0f802ff41a8b41

Download Submit
C:\Users\Admin\AppData\Local\Temp\lEYiUjnA.xlsm

Filesize
25KB

MD5
151e5d7473f91624662276e5e3a64b60

SHA1
0a74d830cac0ee98d810f27701c780e613148a9c

SHA256
bd113e3e85fb2f7b13177edbde4fac8acf55e48370b41e8b5181686e570a430e

SHA512
d5b58d68046a8e2c2d3f061cbf252e708c07da8dceb8acc935166ecfea82f0a8f3b638b6466dcfee1c1a8c99a41d9909f2bd4910d59b8ed0051881e6dc0987e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lEYiUjnA.xlsm

Filesize
27KB

MD5
becf6dada1f6280e2ad81fe421461f59

SHA1
c82f64c14fd533912b382fad2763b5b2fec8b12e

SHA256
d592128e053aa68fddad196240707f0ecc262310fdc4ad7c8bb0e2f85b5dbbb5

SHA512
b9c569bb82bdb917e57ad795cd0ff9f89903058678a264455829c9a2e7711358c3447998041b95b838c77ea28fabb87df277ffa3814327e8c0683bc07b9fa902

Download Submit
C:\Users\Admin\AppData\Local\Temp\lEYiUjnA.xlsm

Filesize
32KB

MD5
4fb7447de84a4ea90605dccb969260ba

SHA1
56e7667eff31bbff49b13b074d58dd07a3a75a5c

SHA256
7f3908065baf96ef83f8ba4f37dd67b68f22921f2be04cdd8ed4f8f9533a3f94

SHA512
07ac6101f5d872018bdd20a21dd68534ab33b52514cd7e490b845a4a8bc706d99ef727e12bad15640f9908a374ebf2cfaa5bd1fc8b25baca467a908c49d953fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\lEYiUjnA.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_21d23ee41a142f6399afba67164c12ff6147fbad45bdeadc1ac394c039296543N.exe

Filesize
416KB

MD5
c51eb3ce1c40dc64487baf70a38d2493

SHA1
e236b7cdcd085286ee4dbfdeebb96053b0648f19

SHA256
827ce8c698f933e5df0784ac9c759992335f5d5f7c7018ccbf3e32fef65553ba

SHA512
d4863e488244386342ed669c972dde4115165fcb6885aed02f171a54be715d210da81258155a4226115a4802c754c5b2bfc3c35802797f6907f845099acff149

Download Submit
memory/1636-36-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/1636-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1912-131-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/1912-132-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/1912-164-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2576-64-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2576-130-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads