Overview

overview

10

Static

static

10

VPN Plus V...us.exe

windows7-x64

10

VPN Plus V...us.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    21-12-2024 04:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VPN Plus V2/VPN Plus.exe

  • Size

    1.9MB

  • MD5

    2fee446f1eefd868e785c8a95d3720f3

  • SHA1

    20c436ebef64a8798d771aaf1caf26ba958ff979

  • SHA256

    25cf545a806ad8c33e1eaaeb424d90645900824c1a9ab79c5274c61654efe6b4

  • SHA512

    29add930c9f0b9c613c57997ee7a1c7d15be196d9d679aa0c8d3a528b34dd1f8356f1beb68bef6855d64bff84ee5e7a4ce6791893932bbb05ac653b930ed613e

  • SSDEEP

    24576:AnsJ39LyjbJkQFMhmC+6GD9srOHOPC0wrdqDQc7t/wqqh8jWpo:AnsHyjtk2MYC5GD+OHOPUkzj

Score
10/10
xredbackdoordiscoverymacropersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Suspicious Office macro 2 IoCs

    Office document equipped with macros.

    macro
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\VPN Plus V2\VPN Plus.exe
    "C:\Users\Admin\AppData\Local\Temp\VPN Plus V2\VPN Plus.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Users\Admin\AppData\Local\Temp\VPN Plus V2\._cache_VPN Plus.exe
      "C:\Users\Admin\AppData\Local\Temp\VPN Plus V2\._cache_VPN Plus.exe"
      2⤵
      • Executes dropped EXE
      PID:2688
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Users\Admin\AppData\Local\Temp\VPN Plus V2\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\VPN Plus V2\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2764
        • C:\Users\Admin\AppData\Roaming\VPN Plus Config.exe
          "C:\Users\Admin\AppData\Roaming\VPN Plus Config.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2816
          • C:\Windows\system32\CMD.exe
            "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Windows Defender" /tr "C:\Windows\Registry" & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1700
            • C:\Windows\system32\schtasks.exe
              SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Windows Defender" /tr "C:\Windows\Registry"
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2928
        • C:\Users\Admin\AppData\Roaming\VPNPlus.exe
          "C:\Users\Admin\AppData\Roaming\VPNPlus.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1020
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe
    Filesize

    1.9MB

    MD5

    2fee446f1eefd868e785c8a95d3720f3

    SHA1

    20c436ebef64a8798d771aaf1caf26ba958ff979

    SHA256

    25cf545a806ad8c33e1eaaeb424d90645900824c1a9ab79c5274c61654efe6b4

    SHA512

    29add930c9f0b9c613c57997ee7a1c7d15be196d9d679aa0c8d3a528b34dd1f8356f1beb68bef6855d64bff84ee5e7a4ce6791893932bbb05ac653b930ed613e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\JH6Kbmzb.xlsm
    Filesize

    24KB

    MD5

    eedfed85676805ee2203e131c8fbdee8

    SHA1

    daffcc908a03af3983644cba0d664286c8cbe094

    SHA256

    654a8e87330eb754f175f13ae95dfa56fedb3d82f26be607d7b0fb2b1ae55f53

    SHA512

    f04fe8e5abb63a874332f730fb5bd350871b50c96f189d771ad18f17800e96b39cd4629a1d5906609cd5614e35abaa45f5922b76f5643e8040b201e789567101

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\JH6Kbmzb.xlsm
    Filesize

    29KB

    MD5

    b184d78222a2e3ca5c86c152fb927d0a

    SHA1

    1c5eb42bcf82b789d8e63f24aca96ffae01b940d

    SHA256

    7d83219be442e41bb9cc3976e380786b341cbe7fd8b922b29e0aca5321edb0c9

    SHA512

    fda1dac85e4a524d97f2ef1d2a5c4ad163f1f96c4de6dde9237119925ccd8fa6ec2d3827415b3e02ffa11375cc6a51024a824d659becb734ac5e2962ba9a07f2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\JH6Kbmzb.xlsm
    Filesize

    30KB

    MD5

    0746180a2d51c577fab6e41c125fdb7c

    SHA1

    2318fc28bf243d8d16f66c3260d7e894e4cb0f98

    SHA256

    3cda0b2786b71e877d4d554ea024a851b0534aa2625f288fd9b53b3437f0cb53

    SHA512

    c30cc74a807999020557136a1a1da02b637e484b77303c02c1b5e8d040b54043a104b319236cd310d0288a0d2bd82a8cb582931623ae8683d27a5116751450e2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\JH6Kbmzb.xlsm
    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\VPN Plus V2\._cache_VPN Plus.exe
    Filesize

    1.1MB

    MD5

    710ab55f4ef1bca71fc375eb5f8970bd

    SHA1

    bce86fc001249d537022c6e1a2ea3268432a1525

    SHA256

    2ed1553c925e60d69b36bc4f99eeecd0f266ff02efed4a0a49d9a31afaf3c5f2

    SHA512

    cf02b8b3f4628c2514d9a850c460ed452bca458988ce71d151877bc316bd8000aa0a5631c6ccb5f43aa5d83fbe5cd9826a65456e87fcdd7afcb2aef2cbca7cf7

    Download Submit

  • C:\Users\Admin\AppData\Roaming\VPN Plus Config.exe
    Filesize

    293KB

    MD5

    810d350794a00247069a152538940195

    SHA1

    df7d2bac8066115056f6fa3c2fbf05991c961958

    SHA256

    047f91f56b6c03885d694d36a1b3cfaa211145c6093f66d2d13fa6aee15a0801

    SHA512

    20f20e6ff80da0232ff00af850e4a3c901cd44f84f6cf38c2c91f16fbaa15c726fee7b3aeceea2ef7c852f4edb2079c3f943a60c985910a9619e24d7b7927c24

    Download Submit

  • C:\Users\Admin\AppData\Roaming\VPNPlus.exe
    Filesize

    444KB

    MD5

    f341dc884269172ef968d8fa6927275b

    SHA1

    5351fe61fd39b7704d9d63b1a36c44746536753d

    SHA256

    2d41af98b1f58fa4c8266629e6a8eec3a06970a4bd8132f722a3ad71457da4e6

    SHA512

    0c6933547a0f76b953a6679027e95f2d557c509ac459004baf2a2bf1bb9176d196eb1bea0ef38c6fe8a5b1ad2ecbf92e10542a2be25b563ab2af82f0bdfb1fde

    Download Submit

  • memory/1020-90-0x0000000001040000-0x00000000010B4000-memory.dmp

    Filesize

    464KB

    Download

  • memory/2188-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2188-27-0x0000000000400000-0x00000000005E7000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2360-37-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2360-115-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2588-116-0x0000000000400000-0x00000000005E7000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2588-374-0x0000000000400000-0x00000000005E7000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2688-32-0x00000000012A0000-0x00000000013CA000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2764-36-0x00000000011B0000-0x00000000012DA000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2816-82-0x0000000000CD0000-0x0000000000D20000-memory.dmp

    Filesize

    320KB

    Download