Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/01/2025, 16:32

General

  • Target

    98d15d74b36ebb0709c4a2f476088a5889fa548029dc90e7e0a070b1f36c4e56N.exe

  • Size

    793KB

  • MD5

    1951df1cc3262a172ce0bd85cc390d00

  • SHA1

    e88411f0b9155eec15712630de1a45b654f52eb3

  • SHA256

    98d15d74b36ebb0709c4a2f476088a5889fa548029dc90e7e0a070b1f36c4e56

  • SHA512

    e06061133c6e987fc53fc1cfb3ddf5394a8d13d8635221bb98dc177f4c794ac3cb3adcbed810d47f6e212cd6082b44021ae9dbe0c113a1bff31a7cda9347aad1

  • SSDEEP

    12288:mMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9TuQj:mnsJ39LyjbJkQFMhmC+6GD9ig

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\98d15d74b36ebb0709c4a2f476088a5889fa548029dc90e7e0a070b1f36c4e56N.exe
    "C:\Users\Admin\AppData\Local\Temp\98d15d74b36ebb0709c4a2f476088a5889fa548029dc90e7e0a070b1f36c4e56N.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:920
    • C:\Users\Admin\AppData\Local\Temp\._cache_98d15d74b36ebb0709c4a2f476088a5889fa548029dc90e7e0a070b1f36c4e56N.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_98d15d74b36ebb0709c4a2f476088a5889fa548029dc90e7e0a070b1f36c4e56N.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4672
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2828
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1808
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1188
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4588
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3900
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2604
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5060
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4464
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4712
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1444
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5080
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1100
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1792
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1728
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4952
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4140
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4408
      • C:\Windows\SysWOW64\cmd.exe
        cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4948
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:672
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1816
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4856
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:540
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:884
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4160
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4452
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4040
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2840
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2588
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:216
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1736
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3240
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4616
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4972
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1544
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3456
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2544
        • C:\Windows\SysWOW64\cmd.exe
          cmd /K C:\Users\Admin\AppData\Local\Temp\mdcrack.exe -d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1928
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2132

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    793KB

    MD5

    1951df1cc3262a172ce0bd85cc390d00

    SHA1

    e88411f0b9155eec15712630de1a45b654f52eb3

    SHA256

    98d15d74b36ebb0709c4a2f476088a5889fa548029dc90e7e0a070b1f36c4e56

    SHA512

    e06061133c6e987fc53fc1cfb3ddf5394a8d13d8635221bb98dc177f4c794ac3cb3adcbed810d47f6e212cd6082b44021ae9dbe0c113a1bff31a7cda9347aad1

  • C:\Users\Admin\AppData\Local\Temp\._cache_98d15d74b36ebb0709c4a2f476088a5889fa548029dc90e7e0a070b1f36c4e56N.exe

    Filesize

    40KB

    MD5

    83db3f55c5a97402b73de7fb23b77add

    SHA1

    7812537505190566cfc04c4708404e25c0750b4d

    SHA256

    af7120cdf209e98bfe63bbc98c176b57987976ab671ab25c5f71d3e72a13a168

    SHA512

    eee63a61b3e86ed029c2ab29bf477e3cc56c956321b29c7a36e947a9441c28bd46ebe629e3955b2339d494cc9cc905581e52af838d088c15b48fdcc557caa916

  • C:\Users\Admin\AppData\Local\Temp\3mdDEsCD.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\A0C75E00

    Filesize

    22KB

    MD5

    8f29bfad5cda71d6ace828951ed0a43d

    SHA1

    7e8578a126a38a236cacd939f7ee2c6336f364a7

    SHA256

    e2849a9d1255ba6abc7a5b2f02288b545ead79caf1b1df3c973e83019bc3a099

    SHA512

    c399abd5096f4b953d46e9bd2c0de603c127d104b36c723d10b15f45c0a047c9a5427d0699fe5bf171f3a4a174d1191bb931509dfb3c0f4109a57974153cdef6

  • memory/672-131-0x0000000002030000-0x0000000002031000-memory.dmp

    Filesize

    4KB

  • memory/672-194-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

  • memory/672-195-0x0000000002030000-0x0000000002031000-memory.dmp

    Filesize

    4KB

  • memory/672-280-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

  • memory/672-249-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

  • memory/920-129-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

  • memory/920-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

    Filesize

    4KB

  • memory/2132-197-0x00007FF97E690000-0x00007FF97E6A0000-memory.dmp

    Filesize

    64KB

  • memory/2132-201-0x00007FF97C170000-0x00007FF97C180000-memory.dmp

    Filesize

    64KB

  • memory/2132-202-0x00007FF97C170000-0x00007FF97C180000-memory.dmp

    Filesize

    64KB

  • memory/2132-200-0x00007FF97E690000-0x00007FF97E6A0000-memory.dmp

    Filesize

    64KB

  • memory/2132-198-0x00007FF97E690000-0x00007FF97E6A0000-memory.dmp

    Filesize

    64KB

  • memory/2132-199-0x00007FF97E690000-0x00007FF97E6A0000-memory.dmp

    Filesize

    64KB

  • memory/2132-196-0x00007FF97E690000-0x00007FF97E6A0000-memory.dmp

    Filesize

    64KB