xred | b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e

General

Target

b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe
Size

1.6MB
MD5

750a20c5c42db077ab92d5c0d412e820
SHA1

b6e239d5a2922f4c52dddf4a97f7bef232971668
SHA256

b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e
SHA512

884e489c2627a66fa4e08b3856e12c4547e6580654a6044ca612c1ca8a7d9148c0c0b1a6e8dafab79afd7df94cce262e908b5720256e1974d3c09c9448f73832
SSDEEP

49152:YnsHyjtk2MYC5GDr9R3ZvxZtEnkkhDcZzlrw:Ynsmtk2aY9R3BjKFhIZzlM

Score

10^/10

xred backdoor discovery macro persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x0009000000019551-108.dat

Executes dropped EXE 3 IoCs

pid	Process
1512	._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe
2752	Synaptics.exe
2924	._cache_Synaptics.exe

Loads dropped DLL 15 IoCs

pid	Process
752	b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe
752	b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe
752	b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe
2752	Synaptics.exe
2752	Synaptics.exe
2940	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2940	WerFault.exe
2492	WerFault.exe
2940	WerFault.exe
2492	WerFault.exe
2940	WerFault.exe
2492	WerFault.exe
2940	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2940	1512	WerFault.exe	31
2492	2924	WerFault.exe	34

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2744	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2924	._cache_Synaptics.exe
1512	._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe
2924	._cache_Synaptics.exe
1512	._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe
2924	._cache_Synaptics.exe
2924	._cache_Synaptics.exe
1512	._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe
1512	._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	._cache_Synaptics.exe
Token: SeDebugPrivilege	1512	._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2744	EXCEL.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1512	752	b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe	31
PID 752 wrote to memory of 1512	752	b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe	31
PID 752 wrote to memory of 1512	752	b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe	31
PID 752 wrote to memory of 1512	752	b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe	31
PID 752 wrote to memory of 2752	752	b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe	33
PID 752 wrote to memory of 2752	752	b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe	33
PID 752 wrote to memory of 2752	752	b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe	33
PID 752 wrote to memory of 2752	752	b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe	33
PID 2752 wrote to memory of 2924	2752	Synaptics.exe	34
PID 2752 wrote to memory of 2924	2752	Synaptics.exe	34
PID 2752 wrote to memory of 2924	2752	Synaptics.exe	34
PID 2752 wrote to memory of 2924	2752	Synaptics.exe	34
PID 2924 wrote to memory of 2492	2924	._cache_Synaptics.exe	37
PID 2924 wrote to memory of 2492	2924	._cache_Synaptics.exe	37
PID 2924 wrote to memory of 2492	2924	._cache_Synaptics.exe	37
PID 2924 wrote to memory of 2492	2924	._cache_Synaptics.exe	37
PID 1512 wrote to memory of 2940	1512	._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe	38
PID 1512 wrote to memory of 2940	1512	._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe	38
PID 1512 wrote to memory of 2940	1512	._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe	38
PID 1512 wrote to memory of 2940	1512	._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe	38

C:\Users\Admin\AppData\Local\Temp\b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe
"C:\Users\Admin\AppData\Local\Temp\b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 592
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2940
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 592
      4⤵
      Loads dropped DLL
      Program crash
      PID:2492

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.6MB

MD5
750a20c5c42db077ab92d5c0d412e820

SHA1
b6e239d5a2922f4c52dddf4a97f7bef232971668

SHA256
b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e

SHA512
884e489c2627a66fa4e08b3856e12c4547e6580654a6044ca612c1ca8a7d9148c0c0b1a6e8dafab79afd7df94cce262e908b5720256e1974d3c09c9448f73832

Download Submit
C:\Users\Admin\AppData\Local\Temp\QskMlVkF.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\QskMlVkF.xlsm

Filesize
25KB

MD5
79e3f9cf27f9dab769ba7576bc0bff1e

SHA1
cd76c4418c11898174a3b4f5140489c3b0fa3e3b

SHA256
e557844da98ae77942987282f66f2fca0a5487032ec779cc4a53da821a8acd2f

SHA512
19f1cf649e6310a29e0dc498607b5107e2747589ae1261efe7e51e7d893b3b456efb4deb573a0bc3f623f225ce8efed97af6fb4510fd1bbf33c7bf37191ea903

Download Submit
C:\Users\Admin\AppData\Local\Temp\QskMlVkF.xlsm

Filesize
21KB

MD5
a655ce88bc6547bc4ba0e48e194bbfb7

SHA1
39c402aa39026edf41d04847fd41f5276b4b352f

SHA256
f09484fd894ad03af86cfcdc41e4f2c3352148cf9afb930c38e4041a2656df67

SHA512
3d80bd1ca1e87328aadb0713eb74dcea022dfb5eb8a491e048aff3a11edf5acb90e59a327fcfb580716ca6fdc2a74d2b5a1453cb795ed0cf9c2f76acc749f200

Download Submit
C:\Users\Admin\AppData\Local\Temp\QskMlVkF.xlsm

Filesize
27KB

MD5
ed77dd276ea48cc9fe2eccf0f74b69d6

SHA1
a28fb6c4b09ef7af9075fb4c89f920dfb62d73e1

SHA256
02c228a3b69718e53657bfae9cbfefdd4257b41ed0d552edd62ccd97017dd50c

SHA512
f16853098a2374e7c2816178d183db214c72e9cb555624a2202394c64b1a4b35e600a9d54b258af4d430df40aab9a8b6b1de8533d6a62789c89b49f4a1c74600

Download Submit
C:\Users\Admin\AppData\Local\Temp\QskMlVkF.xlsm

Filesize
25KB

MD5
ce74ea8a07efed2f8d8377c762d1cc92

SHA1
e15c3ecb1b0f573bc422d3d33ed1b293fab77370

SHA256
df99e8816dacacd73f06f4a94933d8ca21855cd328a068051c21e220eae74824

SHA512
5c761cf90e32468a0f63bc809d721f1e7bcd81706f72e5ff4932b6dd9aadde54100cc4ea832780ce724b6e1968a5519c48b37502c595b107ef75f327ea6b07a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\~$QskMlVkF.xlsm

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_b359afa402e052fc52dd00966ff655444457c50c50dc369e057584ddb813683e.exe

Filesize
921KB

MD5
79eab55d063c88ba3acb01141eef4d1e

SHA1
bd8e9c55c31d7db662317d8b2f50496841f3b15b

SHA256
a353e07b0c173a9ffd8c6c0d6f7c508353ac9d5dded49e1ac0051a1e4919e392

SHA512
7788e965ffeda5cb9ab623ca4fe1a71e27b02cf08819bc483b4501d45f009a62886a95f1d50a491817487a1a875f95c3d70d098c830b8c976c8cc0f242062ff8

Download Submit
memory/752-26-0x0000000000400000-0x00000000005A9000-memory.dmp

Filesize
1.7MB

Download
memory/752-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1512-29-0x0000000000C00000-0x0000000000CF2000-memory.dmp

Filesize
968KB

Download
memory/2744-39-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2744-123-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2752-124-0x0000000000400000-0x00000000005A9000-memory.dmp

Filesize
1.7MB

Download
memory/2752-125-0x0000000000400000-0x00000000005A9000-memory.dmp

Filesize
1.7MB

Download
memory/2752-147-0x0000000000400000-0x00000000005A9000-memory.dmp

Filesize
1.7MB

Download
memory/2752-154-0x0000000000400000-0x00000000005A9000-memory.dmp

Filesize
1.7MB

Download
memory/2924-38-0x0000000000170000-0x0000000000262000-memory.dmp

Filesize
968KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads