xred | 0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84

Analysis

max time kernel
110s
max time network
106s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Size

1.6MB
MD5

8bc5854846987dbb5557fd5864581fb0
SHA1

246f74f7703d9ca56c5c8480374d584bb8971c45
SHA256

0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84
SHA512

b5ab94002baa69de118c0677fbbc7ff15e95779fa80c5424f83a106eea3d418db17937b48e440c865f460d562d2597255266527c886a88845cd3908ea9cfb601
SSDEEP

49152:snsHyjtk2MYC5GD7Zkg6Yf5/pFFFOhKMdDBY:snsmtk2acZkg6YBhFFFOhKMdW

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
2968	Synaptics.exe
2008	._cache_Synaptics.exe

Loads dropped DLL 7 IoCs

pid	Process
2432	0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
2432	0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
2432	0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
2968	Synaptics.exe
2968	Synaptics.exe
2008	._cache_Synaptics.exe
1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\????? = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	._cache_Synaptics.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1512	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2008	._cache_Synaptics.exe
1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2008	._cache_Synaptics.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe
Token: SeDebugPrivilege	2008	._cache_Synaptics.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2008	._cache_Synaptics.exe
1512	EXCEL.EXE
1540	._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 1540	2432	0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe	28
PID 2432 wrote to memory of 1540	2432	0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe	28
PID 2432 wrote to memory of 1540	2432	0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe	28
PID 2432 wrote to memory of 1540	2432	0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe	28
PID 2432 wrote to memory of 2968	2432	0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe	29
PID 2432 wrote to memory of 2968	2432	0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe	29
PID 2432 wrote to memory of 2968	2432	0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe	29
PID 2432 wrote to memory of 2968	2432	0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe	29
PID 2968 wrote to memory of 2008	2968	Synaptics.exe	30
PID 2968 wrote to memory of 2008	2968	Synaptics.exe	30
PID 2968 wrote to memory of 2008	2968	Synaptics.exe	30
PID 2968 wrote to memory of 2008	2968	Synaptics.exe	30

C:\Users\Admin\AppData\Local\Temp\0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
"C:\Users\Admin\AppData\Local\Temp\0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1540
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2008

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.6MB

MD5
8bc5854846987dbb5557fd5864581fb0

SHA1
246f74f7703d9ca56c5c8480374d584bb8971c45

SHA256
0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84

SHA512
b5ab94002baa69de118c0677fbbc7ff15e95779fa80c5424f83a106eea3d418db17937b48e440c865f460d562d2597255266527c886a88845cd3908ea9cfb601

Download Submit
C:\Users\Admin\AppData\Local\Temp\eBKcJxUn.xlsm

Filesize
25KB

MD5
17d62626821434610b741622bbf72146

SHA1
aced425dddd3b5aae535c99598ae9ff9f12b95ac

SHA256
628ba61717c16fd76a917f2ad12632ed94e35048b2eb9750bdf0bb8d1b6288b0

SHA512
4689ce1f1f2cc8ffba1aa4300d1e7fa9e3f6c49eec1d48f63f6238cc1699d765880207df529d16f35d8e469eacd1627281c248962f7a08160d663e3f4cd6316e

Download Submit
C:\Users\Admin\AppData\Local\Temp\eBKcJxUn.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\eBKcJxUn.xlsm

Filesize
28KB

MD5
07f1b031cab2ba4e22cf9886b768098c

SHA1
0d8a74b7dbba488c8e08bc89d2fdcfa268e3d98b

SHA256
f96dbe950fe9308d842f4faf9bb051553724adc6ad1fa07dfa0f11b33dc6af63

SHA512
93008e814b5562827b4139d2941c25049af4fe29ad98807d41003dfb1f2732eaadd8467f16c38ef873575da5299ae4c06c3f96f674fefdeb41e164758faa5cc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\eBKcJxUn.xlsm

Filesize
28KB

MD5
f7948ef0384ad812e64b3421a576c904

SHA1
8196d73b1c55cc9191b091b538954ec5ad794eae

SHA256
c210c7800c6540e55db5f7635ba1d05697510a03f0058f059315221b85a39ceb

SHA512
6867da5854f99c0b666943f41f05f10602708efbb179f4ca6e561ec70cb87ad294933bdfc3de646b3d13e304c2713ac35ca9e1921300e5bed03ae97e247cb34a

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_0a7aa19b240796b21933cc872acd9c5384680a52c119ce339a19b6b15ecc3d84N.exe

Filesize
922KB

MD5
7ce89829f9fb955dc377529c461852fd

SHA1
8b14f5345bfcfac08c31c284c1a0eee2cd53bcfb

SHA256
9775b4bbe23b8eb93727efe0a6d0b160ae5132a10b223f43200499cf0051a18f

SHA512
7b9cd587ba53f632a1eff914a6a4bfc345b2232ed6dc02dfefa9bc9aebe06ff7836c1698077f41483a34b0610e92549b1a4baf8b9e9b29c28469f53ec6722e0c

Download Submit
memory/1512-36-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2432-25-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/2432-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2968-35-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/2968-104-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/2968-106-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/2968-138-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download