xred | 33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc

General

Target

33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe
Size

2.0MB
MD5

214b89daf10eac599849585b0cdcc17f
SHA1

130d23e90e1664d1de99064085a967622fd30163
SHA256

33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc
SHA512

b2209e3dd612cc933f204ca0825d4467667b1e208a0a45c8f4d9a4ab88b0b94967a12cc9b0a4b7c658c1e826a0dbdb2b322e83e92949c63260291cef0293a38b
SSDEEP

49152:XnsHyjtk2MYC5GDgvRlyycuEU7NyZ7JOyra/uN4c:Xnsmtk2aXy1uEU7Nu7JOyUu

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
2152	._cache_33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe
2960	Synaptics.exe
2080	._cache_Synaptics.exe

Loads dropped DLL 7 IoCs

pid	Process
2780	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe
2780	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe
2780	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe
2780	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe
2960	Synaptics.exe
2960	Synaptics.exe
2960	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2712	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2712	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2152	2780	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe	30
PID 2780 wrote to memory of 2152	2780	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe	30
PID 2780 wrote to memory of 2152	2780	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe	30
PID 2780 wrote to memory of 2152	2780	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe	30
PID 2780 wrote to memory of 2960	2780	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe	31
PID 2780 wrote to memory of 2960	2780	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe	31
PID 2780 wrote to memory of 2960	2780	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe	31
PID 2780 wrote to memory of 2960	2780	33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe	31
PID 2960 wrote to memory of 2080	2960	Synaptics.exe	32
PID 2960 wrote to memory of 2080	2960	Synaptics.exe	32
PID 2960 wrote to memory of 2080	2960	Synaptics.exe	32
PID 2960 wrote to memory of 2080	2960	Synaptics.exe	32

C:\Users\Admin\AppData\Local\Temp\33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe
"C:\Users\Admin\AppData\Local\Temp\33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Users\Admin\AppData\Local\Temp\._cache_33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe"
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    PID:2080

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
2.0MB

MD5
214b89daf10eac599849585b0cdcc17f

SHA1
130d23e90e1664d1de99064085a967622fd30163

SHA256
33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc

SHA512
b2209e3dd612cc933f204ca0825d4467667b1e208a0a45c8f4d9a4ab88b0b94967a12cc9b0a4b7c658c1e826a0dbdb2b322e83e92949c63260291cef0293a38b

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1ExSE6d.xlsm

Filesize
35KB

MD5
2ffd7b71eb2384f57477c3c74b15f613

SHA1
d7365c1578d06b8c7c326d04d0fe0e5fe796b2da

SHA256
288b9c75ac19e2132441937e279628f66be3d81581a24fc472eb54c0bb51ab57

SHA512
9fdd61f5fc8b912329155af6eba521e78f8df0927175aff558ed79e9641f88fe4d01b15044e25a5455436c05313004ab552ee0eae581ae09f96299ee5bfa9255

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1ExSE6d.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1ExSE6d.xlsm

Filesize
27KB

MD5
69a16cda840b361237ce20a460b34139

SHA1
24e9c983029908dbb5a37e523e99dee68a197180

SHA256
22bd7493d387f12a3609c190ba1a1449f914003509988a91b251eab40dc3ddb0

SHA512
99da573e0668e9ce5b6c5795229a6002d0963c8d2dcccc0ed9e7595013bdbfcf3eea4c83e28880d0651a863423d1a520524593b058ebfea0ae191933139b67a0

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_33ee66ee4da39cecfdb7de658175cd792109b8764b032f01a02f7d35fac655fc.exe

Filesize
1.2MB

MD5
e2c16921ee7d949dbb70234fc235f726

SHA1
8f97c737f378559e257804accdc8fa73a179143a

SHA256
bdfe57913c83bc1e5647ef0b75c647ff3b36673790d2abb3593dcf9f1b426ad6

SHA512
184d7b3b0e67ca9fabdf85f4c70a319fbbca63b07ce7e487e5a539eda9d93de9b757a32e132d0d50f64b7f45bd4f7e271e2e41c0d972b462188f2cf2ba362205

Download Submit
memory/2080-51-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2080-47-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2080-48-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2080-49-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2080-50-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2152-23-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2152-24-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2152-53-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2152-52-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2152-21-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2152-54-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2152-20-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2152-25-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2152-22-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2712-55-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2712-107-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2780-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2780-34-0x0000000000400000-0x00000000005F9000-memory.dmp

Filesize
2.0MB

Download
memory/2960-108-0x0000000000400000-0x00000000005F9000-memory.dmp

Filesize
2.0MB

Download
memory/2960-143-0x0000000000400000-0x00000000005F9000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads