Overview

overview

10

Static

static

1

OpenPurcha...24.vbs

windows7-x64

10

OpenPurcha...24.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2024 10:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    OpenPurchaseOrderSummaryDetails-16-12-2024.vbs

  • Size

    643B

  • MD5

    3611c7e36499135086695c11f2898395

  • SHA1

    b77dff01a77538f9cdcc86dbb45138f5b9da63b9

  • SHA256

    01e6f507f507e2093552b08d51a575f106bb818cd6f32e2d158543f66d2a11a0

  • SHA512

    2023cf992575aa300967d6ca949aea665ccf9ce0235084bf1e143ebb2678f5657d37a8a4f6eafeee1cc9e5849014b59285cdadb98552fb93a85506f55672e4cb

Score
10/10
xredbackdoordiscoverypersistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • NTFS ADS 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\OpenPurchaseOrderSummaryDetails-16-12-2024.vbs"
    1⤵
    • Blocklisted process makes network request
    • Drops startup file
    • Suspicious use of WriteProcessMemory
    PID:5112
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:384
      • C:\Users\Admin\AppData\Local\Temp\._cache_Google.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Google.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:3792
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn BBLXFG.exe /tr C:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exe /sc minute /mo 1
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1888
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn BBLXFG.exe /tr C:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exe /sc minute /mo 1
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:1820
        • C:\Windows\SysWOW64\WSCript.exe
          WSCript C:\Users\Admin\AppData\Local\Temp\BBLXFG.vbs
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3476
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5036
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2300
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1864
  • C:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exe
    C:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4380
  • C:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exe
    C:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:596
  • C:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exe
    C:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\._cache_Google.exe
    Filesize

    1.4MB

    MD5

    df6fa61ac1509c2d8b720690829d5634

    SHA1

    4430a5461b9c0b5fb8ad0398edad7b5e89159441

    SHA256

    90520e67bffe18505e7d77356a0adbf8ab6663862ef765387eeaf6e2ce5a32d6

    SHA512

    4f953ead572c92bde737227c1afa88bc2d274118e42c99e9245405b4748fa0f258ca8b334ecf219e5c7d2adbbf9185ca4cbbdcc5ef312c26aa7e81bd32d0610c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\5AxHheUy.xlsm
    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\94875E00
    Filesize

    23KB

    MD5

    b0d42d58a1eb13cf8bfb2e3b5b1d5ed7

    SHA1

    9682e15ca98d2cb3f4d1c7e307dffe7c0a1a1fad

    SHA256

    1060b683bda471adef88e8248042fd5534e2cc8829c39e533cab56f94d08533f

    SHA512

    1c248bd3518e8a302411e9a52eb018463ecb61243c23e2ae3f68e6b6bfc6ed6052729071ce956fd43fda7fae4fefd96a10f35515a434c1ae6f547cd64ff3fbc9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\BBLXFG.vbs
    Filesize

    848B

    MD5

    38633df408eab071a57c8705ceab5625

    SHA1

    e0969c4b1d47dae8ba51b829f7b453bed52a7f23

    SHA256

    c31c483041db528685798e46af3a872d0b5aa00a3a0df1bac85a253d5ae24aad

    SHA512

    c9c42135f180bd7364c737b2c2a2ac1df0ec735f66d393d39e86b62006ac4f525fa543cae00c284b45df33ba76a0527e8f36069282a1142011ab69f69a9e61f5

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe
    Filesize

    2.1MB

    MD5

    38d3095d1b748cd53c65395718d7c5f4

    SHA1

    3c0221471b641a641a9141a731f6ee09663e6538

    SHA256

    f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6

    SHA512

    f0ab6ed5dfa52d8159c5090fd96087ba8e89c26c2fdb90fae3f4d19b6952250ecd49846b9198d7c77affb6fabe3a0e53758392409a73552b202591433afc03e6

    Download Submit

  • memory/384-142-0x0000000000400000-0x0000000000620000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/384-14-0x00000000024C0000-0x00000000024C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1864-211-0x00007FFB462F0000-0x00007FFB46300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1864-212-0x00007FFB462F0000-0x00007FFB46300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1864-210-0x00007FFB462F0000-0x00007FFB46300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1864-213-0x00007FFB462F0000-0x00007FFB46300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1864-209-0x00007FFB462F0000-0x00007FFB46300000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1864-214-0x00007FFB44180000-0x00007FFB44190000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1864-215-0x00007FFB44180000-0x00007FFB44190000-memory.dmp

    Filesize

    64KB

    Download

  • memory/5036-264-0x0000000000400000-0x0000000000620000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/5036-297-0x0000000000400000-0x0000000000620000-memory.dmp

    Filesize

    2.1MB

    Download