xred | 215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a

General

Target

215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe
Size

1.3MB
MD5

ab58ab55440689c04b56b978f2bbff60
SHA1

cfeb7e14911534f447a67e05577d3f21e8fbb326
SHA256

215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a
SHA512

ee9005fb54e7756a78a22e191aa37ef56b60e7de8300148963bbc638d2ae0fa2955436f153ed555ce095275c9d736da35d1cd1803a526356191df175ab119be0
SSDEEP

24576:JnsJ39LyjbJkQFMhmC+6GD92amx88FgqIK0KjmaAer:JnsHyjtk2MYC5GDRVpAAO

Score

10^/10

xred backdoor discovery macro persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x0007000000019480-89.dat

Executes dropped EXE 3 IoCs

pid	Process
2744	._cache_215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe
2136	Synaptics.exe
2652	._cache_Synaptics.exe

Loads dropped DLL 7 IoCs

pid	Process
2272	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe
2272	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe
2272	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe
2272	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe
2136	Synaptics.exe
2136	Synaptics.exe
2136	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2728	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2728	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2744	2272	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe	30
PID 2272 wrote to memory of 2744	2272	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe	30
PID 2272 wrote to memory of 2744	2272	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe	30
PID 2272 wrote to memory of 2744	2272	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe	30
PID 2272 wrote to memory of 2136	2272	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe	31
PID 2272 wrote to memory of 2136	2272	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe	31
PID 2272 wrote to memory of 2136	2272	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe	31
PID 2272 wrote to memory of 2136	2272	215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe	31
PID 2136 wrote to memory of 2652	2136	Synaptics.exe	32
PID 2136 wrote to memory of 2652	2136	Synaptics.exe	32
PID 2136 wrote to memory of 2652	2136	Synaptics.exe	32
PID 2136 wrote to memory of 2652	2136	Synaptics.exe	32

C:\Users\Admin\AppData\Local\Temp\215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe
"C:\Users\Admin\AppData\Local\Temp\215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\._cache_215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe"
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    PID:2652

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.3MB

MD5
ab58ab55440689c04b56b978f2bbff60

SHA1
cfeb7e14911534f447a67e05577d3f21e8fbb326

SHA256
215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a

SHA512
ee9005fb54e7756a78a22e191aa37ef56b60e7de8300148963bbc638d2ae0fa2955436f153ed555ce095275c9d736da35d1cd1803a526356191df175ab119be0

Download Submit
C:\Users\Admin\AppData\Local\Temp\G2bVgcAG.xlsm

Filesize
25KB

MD5
34b6d4a00107efaa9a54ddf05f960bd7

SHA1
0574c7568f77dfe396c7ec72ead55860f0e790de

SHA256
96e073f4e562557f8e5c326037dc5319ed8fafb214b370142968fa90c218323c

SHA512
9e6a1f9aa64ac67f4e1b4a7ffa515fd5d6d724534a6acf9215e32d1fd1caa90fe196c73baaecbc97ba9dd40ffa6480f2146cf04057a2c8d18192efeae2b5b6ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\G2bVgcAG.xlsm

Filesize
26KB

MD5
2550c88d182c97fbfc35a789a33f3b2c

SHA1
c0c26d4ea5295d294c7cef54d6daaa017cf82255

SHA256
50e7ce2edd2c5a6111fbf349fe58d768d23b59c755e8b3a3973196042787c3af

SHA512
3f704bf5081e76a5c54d38cff08db53206e648e4e68c7712e60b3c24cd21468bf0aff66a83cdb14789e1b3659541f51060246ef6c80a334e9e5da6b94d302654

Download Submit
C:\Users\Admin\AppData\Local\Temp\G2bVgcAG.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\G2bVgcAG.xlsm

Filesize
34KB

MD5
7fb4d9254a0f19d3f381889efdc689e4

SHA1
543c05c14041686d9f29d16e5818cf7c3b3e75a9

SHA256
c6fe73c15f35424e4b6cf39a7967faeeeea73bf19a6d6f25eaa249b96c2187d8

SHA512
5305e1ca2a440d453553b66e8a1facd87f3af16934c08592b6ecccb375887ef57f4ad1b1c6fc29bf2f433075b18a01f54e4cfd75a19523eb3cf0b21c885b8879

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_215dd63304607b1e28fa80e6aa568d37c6479e68c6fd96cfb85b1d67957d308a.exe

Filesize
580KB

MD5
89fadc3fffa70a3589968b544d07913d

SHA1
08c0fea24e14cd7294cba37e51dbc6927bbae726

SHA256
d509b098f77b3397aa2d2132383d2ed98e240b3e2fd5d4d74c4f53cfd242b5e4

SHA512
e9868f823fe3ddf8bec61c5f51ace83bc542c3fc47bb204555eb33f85f352a8ab42cb34ae1ceff0b9151ebf0b7a2651929ec6d8dfb09b6070c7c6a87952f94ae

Download Submit
memory/2136-107-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2136-142-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2136-108-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2272-28-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2272-0-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2728-106-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2728-41-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads