xred | 463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1

General

Target

463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe
Size

1.1MB
MD5

f47b36975ca63fbbb7cc52fa288f9587
SHA1

0753f298afdac423373df39d94077eb7d32a740e
SHA256

463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1
SHA512

c6b0d8c1c9e57516570c959c5ac24cf7f7a27d002ae397ee76cc25fb6ab75f68f79db4246bb97e0253e4fd876165e5cef51054d9ca128877789dc9694dc57604
SSDEEP

24576:YnsJ39LyjbJkQFMhmC+6GD9RsxWEGvLvbfLXsa9:YnsHyjtk2MYC5GD/AOPjXR

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
2856	._cache_463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe
2680	Synaptics.exe
2580	._cache_Synaptics.exe

Loads dropped DLL 7 IoCs

pid	Process
2372	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe
2372	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe
2372	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe
2372	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe
2680	Synaptics.exe
2680	Synaptics.exe
2680	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash	._cache_Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf	._cache_Synaptics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf\ = "ShockwaveFlash.ShockwaveFlash"	._cache_Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl	._cache_Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command	._cache_Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell	._cache_Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open	._cache_Synaptics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\._cache_Synaptics.exe %1"	._cache_Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon	._cache_Synaptics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\._cache_Synaptics.exe,1"	._cache_Synaptics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl\ = "ShockwaveFlash.ShockwaveFlash"	._cache_Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2464	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2464	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2856	2372	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe	30
PID 2372 wrote to memory of 2856	2372	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe	30
PID 2372 wrote to memory of 2856	2372	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe	30
PID 2372 wrote to memory of 2856	2372	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe	30
PID 2372 wrote to memory of 2680	2372	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe	31
PID 2372 wrote to memory of 2680	2372	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe	31
PID 2372 wrote to memory of 2680	2372	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe	31
PID 2372 wrote to memory of 2680	2372	463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe	31
PID 2680 wrote to memory of 2580	2680	Synaptics.exe	32
PID 2680 wrote to memory of 2580	2680	Synaptics.exe	32
PID 2680 wrote to memory of 2580	2680	Synaptics.exe	32
PID 2680 wrote to memory of 2580	2680	Synaptics.exe	32

C:\Users\Admin\AppData\Local\Temp\463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe
"C:\Users\Admin\AppData\Local\Temp\463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\._cache_463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2856
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2580

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.1MB

MD5
f47b36975ca63fbbb7cc52fa288f9587

SHA1
0753f298afdac423373df39d94077eb7d32a740e

SHA256
463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1

SHA512
c6b0d8c1c9e57516570c959c5ac24cf7f7a27d002ae397ee76cc25fb6ab75f68f79db4246bb97e0253e4fd876165e5cef51054d9ca128877789dc9694dc57604

Download Submit
C:\Users\Admin\AppData\Local\Temp\BED67F00

Filesize
22KB

MD5
a147d2611ad31a4e77f69689446a7718

SHA1
b3b7dc1d270a5de2e9830aa5367400329ef1dfe5

SHA256
a1de214faea9eedb11fdb4588bde9af8709c13a328fe5800c591cd121e251f21

SHA512
81934a9d365f514de2eca686b026105593f03726d4e8be139d389b9e5be07b41d3a35786b79100ffff0ffff1f7144364431db1fbb0351bdf40fb05e28bbeab9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\WvmKMVk3.xlsm

Filesize
20KB

MD5
c6be7c95908a6a4f964e89f6650a92fd

SHA1
d4103e9a9d59e3bca7da879cdc3ec579015bb425

SHA256
e863b7c4f2d0449c713a9ba500fe9e5cd5de57c4503db02f0941d3efaca5c53a

SHA512
64f3b7df89045655ed9297c91efde6c2609c4dabcccc41a9270c0c1581ad7936ba33b28faf9c5f708252a1e48709c31183e4ad2e3948ebb138d71e4574e87159

Download Submit
C:\Users\Admin\AppData\Local\Temp\WvmKMVk3.xlsm

Filesize
28KB

MD5
5d0105925fc6b1fa95cdde8c61cd8429

SHA1
fe51f409edc10aea514bb017fe3c7cd5ddda61c7

SHA256
841d710888e0b8c27bd0f3d49cd5d4593ba48ad6e727634659e3e523250575a7

SHA512
6b0d2ab7a0fdf6721474af6a04c6d751b970683b49a085db395e01a8fd6c961e54b0204f82cbc6dd86ba7f5cd91afbff520ce720a874e1a3990844ede790e4b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\WvmKMVk3.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\WvmKMVk3.xlsm

Filesize
21KB

MD5
8ce3c7ac3af97f7504260ca78e5aa056

SHA1
ae6180b6841a5a321d630fc15cca32ccf59579a0

SHA256
b2d0fd223735960646c2e87901bd9d14736570a8e2e2b03da011d25cde3a9600

SHA512
41990e1f71b53b0ed4dd574d76ac50c898022564ece981ad6bd9d907526cf28290680b00bf25d79a120541a764b6878e564a3bc9c93c998556fe258396efa65b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~$WvmKMVk3.xlsm

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_463531e72068c8cce342e7d7ffdada72a6bc1c2efa7a4706c413f80d6e8db2b1.exe

Filesize
417KB

MD5
ee796ef385275d6e1e22316c9cf28a53

SHA1
1af3b4ecfd52798b2138b26e06028259671407c3

SHA256
0ae6581b4c0ad588801990c348686aa038901d1f27212c80d38a557c6be7e1c6

SHA512
38cbf660bea7f3629cae8413c3932b0a49d00ae249812c579c87ab31e73dc429aa4edc1f6338e7ec06c795108f56d4c14a38262823f916ea76c0617254628955

Download Submit
memory/2372-29-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/2372-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2464-42-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2464-118-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2680-119-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/2680-120-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/2680-142-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/2680-153-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads