Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-12-2024 10:24
General
-
Target
JPS.exe
-
Size
1.9MB
-
MD5
290a46d2614f4ce4f7ad75d2cea2ce23
-
SHA1
cc9f762b21f649252881087b2ff56e88d4b5a6f1
-
SHA256
7cbe965fa1278ba09c31e191c19ac1e2b52f940b656273872c805833ae03e276
-
SHA512
2a6d87585971cf166d4df1b2bcfe80a8b066d1cf4cbf646addf0735b62644ab5d9624b635aa1ba89b0b36107fd2899bec2f95d6a55d2faff579272e1e758fe98
-
SSDEEP
24576:8nsJ39LyjbJkQFMhmC+6GD9bhloDX0XOf44e7JFtxAnWe2fxYBQl:8nsHyjtk2MYC5GDxhloJfXnWbfxp
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 5 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
AutoIT Executable 18 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
NTFS ADS 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JPS.exe"C:\Users\Admin\AppData\Local\Temp\JPS.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_JPS.exe"C:\Users\Admin\AppData\Local\Temp\._cache_JPS.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn BQQQVU.exe /tr C:\Users\Admin\AppData\Roaming\Windata\XNLAGO.exe /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn BQQQVU.exe /tr C:\Users\Admin\AppData\Roaming\Windata\XNLAGO.exe /sc minute /mo 14⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\BQQQVU.vbs3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Windata\XNLAGO.exeC:\Users\Admin\AppData\Roaming\Windata\XNLAGO.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Windata\XNLAGO.exeC:\Users\Admin\AppData\Roaming\Windata\XNLAGO.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5290a46d2614f4ce4f7ad75d2cea2ce23
SHA1cc9f762b21f649252881087b2ff56e88d4b5a6f1
SHA2567cbe965fa1278ba09c31e191c19ac1e2b52f940b656273872c805833ae03e276
SHA5122a6d87585971cf166d4df1b2bcfe80a8b066d1cf4cbf646addf0735b62644ab5d9624b635aa1ba89b0b36107fd2899bec2f95d6a55d2faff579272e1e758fe98
-
Filesize
1.2MB
MD5fbe9e7e00a80a2321badfa4e962fe15e
SHA1ce7d9083a3a7a5a7f627cf1cdc4946756df3aaa9
SHA2567df6c8d2b3479312e1e8bf177d58e7f69c11b932177f288c0fc0d2aee2f869d7
SHA512a27903f33a6b7b6b003ee5cb80b7ff640ef24d1ca635ce79d15de94f69e6b2bdc8ca3e6e699f130bbc9e6d629312cc48216624a6110caa068c532aa9133646e2
-
Filesize
20KB
MD54ea95c8a2ed998c7d9b6497a2807490d
SHA1cd12d6f4776c4257f533a1fa8fc666f75bdfaf2a
SHA2565b47e6c333172fdfc0590ef699f787e984e8385ab88c550c11bc16746740688d
SHA51220905e3b77cd76a8c3d208a5e17139def22b81e3316c2f52a43b19263c2b03d565a75e4eed8e0674e95c76e82dd5cacc63b67486218f86c7f7b16251b7789996
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
842B
MD598e9e1b1bee7a74a36f3bc7d3d7ef297
SHA136d9ad69c5843458b6430b43e8627cb3b5a90b63
SHA256be551a48231d016d80d54ac08cc6b8b6860ddac5846e418e82a733440e16f101
SHA5120a55cdaa039e5b23e3fe6a08871ca9acbc13710cb8881706cc4cf47501a1b31bbe757447f05dda4b8838fce3261b961bb67cdb1938cb239a0421decd98bf6d8c
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
2.5MB