xred | d1a476d5942564e548c475cde9c17e923d512aae74b2eb86f23b834a117f4d5c

General

Target

Loader.exe
Size

2.2MB
MD5

195ea7a4b2c6c1ac97690b188ace0da5
SHA1

3577d22783350ddc93abe12e08bfb36838ffadd7
SHA256

5c9abc8e84d9da9bedf545bf9221eceaa600a0f3bde6dcf34e30e7e0953cf549
SHA512

964048cdecb66cb726518f19269c568ef998a3aeb10a88ca21ee43c28051094f00dc7e5433dd5c86b9f5713e9e8befb207859c8b8dd25a6f0178163ff45b1f8b
SSDEEP

49152:NnsHyjtk2MYC5GDBTMDYr8Ar8Ar8Ar88ur84HBB:Nnsmtk2a0ADYrvrvrvrpurVHBB

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
2120	._cache_Loader.exe
2140	Synaptics.exe
2988	._cache_Synaptics.exe

Loads dropped DLL 5 IoCs

pid	Process
1992	Loader.exe
1992	Loader.exe
1992	Loader.exe
2140	Synaptics.exe
2140	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_Loader.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_Loader.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2792	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2792	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2120	1992	Loader.exe	30
PID 1992 wrote to memory of 2120	1992	Loader.exe	30
PID 1992 wrote to memory of 2120	1992	Loader.exe	30
PID 1992 wrote to memory of 2120	1992	Loader.exe	30
PID 1992 wrote to memory of 2140	1992	Loader.exe	31
PID 1992 wrote to memory of 2140	1992	Loader.exe	31
PID 1992 wrote to memory of 2140	1992	Loader.exe	31
PID 1992 wrote to memory of 2140	1992	Loader.exe	31
PID 2140 wrote to memory of 2988	2140	Synaptics.exe	32
PID 2140 wrote to memory of 2988	2140	Synaptics.exe	32
PID 2140 wrote to memory of 2988	2140	Synaptics.exe	32
PID 2140 wrote to memory of 2988	2140	Synaptics.exe	32

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\._cache_Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_Loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:2120
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:2988

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
2.2MB

MD5
195ea7a4b2c6c1ac97690b188ace0da5

SHA1
3577d22783350ddc93abe12e08bfb36838ffadd7

SHA256
5c9abc8e84d9da9bedf545bf9221eceaa600a0f3bde6dcf34e30e7e0953cf549

SHA512
964048cdecb66cb726518f19269c568ef998a3aeb10a88ca21ee43c28051094f00dc7e5433dd5c86b9f5713e9e8befb207859c8b8dd25a6f0178163ff45b1f8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MJKlhTFf.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\MJKlhTFf.xlsm

Filesize
20KB

MD5
c0ee89b7bb9d9f1ff18a3600cac44ee7

SHA1
0991a5899283cce717cf52af35b259bd2db032cd

SHA256
be9d76cbb70b4a42d667b958b5a19bbb2e7aa682e335eda5be0afe134fdf7bc7

SHA512
7069ada03265be36ebddde76b9d826358e5cf8430771311ea5581e04ef7e7d3c34e548ab2979c9edc927ff3ef72f0cd19ab63ff74c10386fef98f7b96911968f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MJKlhTFf.xlsm

Filesize
22KB

MD5
14d6e69582a34659320d096e3a51c690

SHA1
a3b2349d3bd8638e785178690d4ff39def999279

SHA256
2343824716b5d113a7821e7e87e9875edd5b1fd319414f313ce3c9727cab6356

SHA512
4cae8b843d20972ec2c83d44db3a00b43dce4a015a313f5f8caa7e28023a101165794488168bfab1d668152be1fe09860b239637f392f60654a02bcf34b36e2b

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_Loader.exe

Filesize
1.4MB

MD5
4978ca60cd9c01098ea4398033f66f35

SHA1
016bad511fe8368c84f66c5cf5fc3156a15418b4

SHA256
6770d62b03739cf224dc1aac5c0c30a40a607da23ed621f2dd3d329f861573f6

SHA512
4ae74e23e1415ab161c005e79c1533fe19b4fcc5c1900e6f4f4dbc8902910437bcb4d7f314d8c58bf88887a7b74296b2b20e572a7c9e46576a675bcba5443d99

Download Submit
memory/1992-26-0x0000000000400000-0x0000000000630000-memory.dmp

Filesize
2.2MB

Download
memory/1992-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2120-29-0x0000000000AA0000-0x0000000000C14000-memory.dmp

Filesize
1.5MB

Download
memory/2140-93-0x0000000000400000-0x0000000000630000-memory.dmp

Filesize
2.2MB

Download
memory/2140-94-0x0000000000400000-0x0000000000630000-memory.dmp

Filesize
2.2MB

Download
memory/2140-126-0x0000000000400000-0x0000000000630000-memory.dmp

Filesize
2.2MB

Download
memory/2792-39-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2792-92-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2988-40-0x0000000004DD0000-0x0000000004FE4000-memory.dmp

Filesize
2.1MB

Download
memory/2988-38-0x00000000012A0000-0x0000000001414000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads