xred | c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482

Analysis

max time kernel
112s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2025, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe
Size 974KB
Sample250102-ndtpzsslgk
SHA256 c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482
MD5 ea97e93b1ed967112ec77ae97744bdfc
SHA1 43a159ca2ccffe816f9fdd05ddaa145cae0c1460
SHA512 483a6d22645f92a53afe9e92fc74295dfeb7a5ec43e7af95476e83f42d72ef24396ca5d3a1d3a47eb7b3a42e4f9fb1a8af33f9ca7763ed3cbef93bd775dae4d4
SSDEEP 12288:vMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9JP04BzFEz+MdaaNW:vnsJ39LyjbJkQFMhmC+6GD9+GzFmXV0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 3 IoCs

pid	Process
3824	._cache_c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe
436	Synaptics.exe
4000	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4328	EXCEL.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 3824	1472	c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe	85
PID 1472 wrote to memory of 3824	1472	c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe	85
PID 1472 wrote to memory of 3824	1472	c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe	85
PID 1472 wrote to memory of 436	1472	c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe	86
PID 1472 wrote to memory of 436	1472	c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe	86
PID 1472 wrote to memory of 436	1472	c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe	86
PID 436 wrote to memory of 4000	436	Synaptics.exe	87
PID 436 wrote to memory of 4000	436	Synaptics.exe	87
PID 436 wrote to memory of 4000	436	Synaptics.exe	87

C:\Users\Admin\AppData\Local\Temp\c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe
"C:\Users\Admin\AppData\Local\Temp\c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Users\Admin\AppData\Local\Temp\._cache_c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3824
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4000

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 974KB
SHA256 c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482
MD5 ea97e93b1ed967112ec77ae97744bdfc
SHA1 43a159ca2ccffe816f9fdd05ddaa145cae0c1460
SHA512 483a6d22645f92a53afe9e92fc74295dfeb7a5ec43e7af95476e83f42d72ef24396ca5d3a1d3a47eb7b3a42e4f9fb1a8af33f9ca7763ed3cbef93bd775dae4d4
SSDEEP 12288:vMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9JP04BzFEz+MdaaNW:vnsJ39LyjbJkQFMhmC+6GD9+GzFmXV0
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_c5f30fd383e22ae8cebbd8ff78a32e5743af2672179906d51c9707372f014482.exe
Size 220KB
SHA256 2f4ebf3b8ed9891d49f9d87433cfaedd67928aa31ad12f8d084d99ffa18d51a7
MD5 85c890c6e1e01134b6bcd3a388a1fbdd
SHA1 a7dd8a21a3ded56c0ad565e5bd588124d7cbf1bd
SHA512 5c54cb77eb5eae4ebb45dc1e1f8d544b8c9eb9ff028c26ca2262c02f8193c9ccf78ef821085c4e78a7906b7b423e493235c9e6daea4f83dde2e65b517133ebdc
SSDEEP 6144:vTpup4u6z1zTE/9IKWnzaJ1werTsebfdaaF:N04BzFEz+MdaaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

8DA75E00

Path C:\Users\Admin\AppData\Local\Temp\8DA75E00
Size 20KB
SHA256 34adcf54cf444622157de37bfdaef2b9e6e53c7d0d87da6c744a85f36b9f0936
MD5 2428c3b2a9fa27e8b2b6a70137700e37
SHA1 d6e0da8a7b26f6124efbf3c9f0b0972eea9466a2
SHA512 c9b6d7034be4d68e67a8262b053c6fe9358ab2876843920fcc76d741afc67c54b79fb640f0ea466fa142fe5b07424455aa9ee90bcbc1efe5463b511b99aae11c
SSDEEP 384:MO30S8Kop+o5byn37kbl8wxcqhMaSq4J7sHZIcQOAIqxHVXa4YCTI:MO373o4o5bynobi6c0r4wCcUVXaF2I
MD5 SHA1 SHA512 SSDEEP

Submit Download

JrebSyhe.xlsm

Path C:\Users\Admin\AppData\Local\Temp\JrebSyhe.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-102-0x0000000002160000-0x0000000002161000-memory.dmp

Download

memory/436-189-0x0000000000400000-0x00000000004FA000-memory.dmp

Download

memory/436-190-0x0000000002160000-0x0000000002161000-memory.dmp

Download

memory/436-221-0x0000000000400000-0x00000000004FA000-memory.dmp

Download

memory/1472-0-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/1472-101-0x0000000000400000-0x00000000004FA000-memory.dmp

Download

memory/4328-138-0x00007FFEC4FD0000-0x00007FFEC4FE0000-memory.dmp

Download

memory/4328-137-0x00007FFEC4FD0000-0x00007FFEC4FE0000-memory.dmp

Download

memory/4328-136-0x00007FFEC4FD0000-0x00007FFEC4FE0000-memory.dmp

Download

memory/4328-139-0x00007FFEC4FD0000-0x00007FFEC4FE0000-memory.dmp

Download

memory/4328-140-0x00007FFEC4FD0000-0x00007FFEC4FE0000-memory.dmp

Download

memory/4328-141-0x00007FFEC2720000-0x00007FFEC2730000-memory.dmp

Download

memory/4328-142-0x00007FFEC2720000-0x00007FFEC2730000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads