xred | 457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34

Analysis

max time kernel
141s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
Size

5.7MB
MD5

100620cd1016f9b7aed030b8eced2afd
SHA1

f98f52d52fa58ea5d9b179d28422109958e1b3e2
SHA256

457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34
SHA512

b092244989f027692ee5cc4475611469c8ead213dde075493a6f6a5d3b81371d428958617c58a6c16dbadf75cb878fe279c0140f1629a169392e5f14e6c0f08d
SSDEEP

98304:znsmtk2ahd+T6Kn5kBqUMWirt49K9nWBp5doWp/IZviyJrw:LLQdxK3z49K9I5B0vJw

Score

10^/10

xred xworm backdoor discovery persistence rat trojan

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

xworm

Version

5.0

45.141.26.134:7000

Mutex

CcojtGUool4u0Nw2

Attributes

Install_directory
%Userprofile%
install_file
svchost.exe

aes.plain

Signatures

Detect Xworm Payload 7 IoCs

resource	yara_rule
behavioral1/files/0x0034000000015d5c-48.dat	family_xworm
behavioral1/memory/3032-60-0x0000000000D40000-0x0000000000D50000-memory.dmp	family_xworm
behavioral1/files/0x00080000000162b8-59.dat	family_xworm
behavioral1/memory/2916-57-0x0000000000400000-0x00000000004CC000-memory.dmp	family_xworm
behavioral1/memory/2232-85-0x0000000000B80000-0x0000000000B90000-memory.dmp	family_xworm
behavioral1/memory/2744-122-0x0000000000C50000-0x0000000000C60000-memory.dmp	family_xworm
behavioral1/memory/1444-130-0x0000000000EF0000-0x0000000000F00000-memory.dmp	family_xworm

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 9 IoCs

pid	Process
2704	._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
2756	Synaptics.exe
1920	._cache_Synaptics.exe
800	Fulloptionnew_by elegance.exe
2916	svchost.exe
3032	._cache_svchost.exe
2232	svchost.exe
2744	svchost.exe
1444	svchost.exe

Loads dropped DLL 8 IoCs

pid	Process
2888	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
2888	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
2888	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
2756	Synaptics.exe
2756	Synaptics.exe
2704	._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
2916	svchost.exe
2916	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\svchost.exe"	._cache_svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1580	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2240	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3032	._cache_svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	._cache_svchost.exe
Token: SeDebugPrivilege	3032	._cache_svchost.exe
Token: SeDebugPrivilege	2232	svchost.exe
Token: SeDebugPrivilege	2744	svchost.exe
Token: SeDebugPrivilege	1444	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2240	EXCEL.EXE
3032	._cache_svchost.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2704	2888	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	30
PID 2888 wrote to memory of 2704	2888	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	30
PID 2888 wrote to memory of 2704	2888	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	30
PID 2888 wrote to memory of 2704	2888	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	30
PID 2888 wrote to memory of 2756	2888	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	31
PID 2888 wrote to memory of 2756	2888	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	31
PID 2888 wrote to memory of 2756	2888	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	31
PID 2888 wrote to memory of 2756	2888	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	31
PID 2756 wrote to memory of 1920	2756	Synaptics.exe	32
PID 2756 wrote to memory of 1920	2756	Synaptics.exe	32
PID 2756 wrote to memory of 1920	2756	Synaptics.exe	32
PID 2756 wrote to memory of 1920	2756	Synaptics.exe	32
PID 2704 wrote to memory of 800	2704	._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	33
PID 2704 wrote to memory of 800	2704	._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	33
PID 2704 wrote to memory of 800	2704	._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	33
PID 2704 wrote to memory of 2916	2704	._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	34
PID 2704 wrote to memory of 2916	2704	._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	34
PID 2704 wrote to memory of 2916	2704	._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	34
PID 2704 wrote to memory of 2916	2704	._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	34
PID 2916 wrote to memory of 3032	2916	svchost.exe	35
PID 2916 wrote to memory of 3032	2916	svchost.exe	35
PID 2916 wrote to memory of 3032	2916	svchost.exe	35
PID 2916 wrote to memory of 3032	2916	svchost.exe	35
PID 3032 wrote to memory of 1580	3032	._cache_svchost.exe	38
PID 3032 wrote to memory of 1580	3032	._cache_svchost.exe	38
PID 3032 wrote to memory of 1580	3032	._cache_svchost.exe	38
PID 2032 wrote to memory of 2232	2032	taskeng.exe	41
PID 2032 wrote to memory of 2232	2032	taskeng.exe	41
PID 2032 wrote to memory of 2232	2032	taskeng.exe	41
PID 2032 wrote to memory of 2744	2032	taskeng.exe	44
PID 2032 wrote to memory of 2744	2032	taskeng.exe	44
PID 2032 wrote to memory of 2744	2032	taskeng.exe	44
PID 2032 wrote to memory of 1444	2032	taskeng.exe	45
PID 2032 wrote to memory of 1444	2032	taskeng.exe	45
PID 2032 wrote to memory of 1444	2032	taskeng.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
"C:\Users\Admin\AppData\Local\Temp\457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Roaming\Fulloptionnew_by elegance.exe
    "C:\Users\Admin\AppData\Roaming\Fulloptionnew_by elegance.exe"
    3⤵
    - Executes dropped EXE
    PID:800
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\._cache_svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_svchost.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\svchost.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1580
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    PID:1920

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2240

C:\Windows\system32\taskeng.exe
taskeng.exe {2FB4EE14-A790-4046-B9CB-7317EB1152D1} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\svchost.exe
  C:\Users\Admin\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Users\Admin\svchost.exe
  C:\Users\Admin\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Users\Admin\svchost.exe
  C:\Users\Admin\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
5.7MB

MD5
100620cd1016f9b7aed030b8eced2afd

SHA1
f98f52d52fa58ea5d9b179d28422109958e1b3e2

SHA256
457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34

SHA512
b092244989f027692ee5cc4475611469c8ead213dde075493a6f6a5d3b81371d428958617c58a6c16dbadf75cb878fe279c0140f1629a169392e5f14e6c0f08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe

Filesize
4.8MB

MD5
adc3667c6060dfdcb6f41bd2b01c31a3

SHA1
54c39168b2d76c54f62f9ba266754581ff599d2d

SHA256
bab41ee900b96a6c768996d935ba44c391c14003c30a278a8ac1e32ebe49a1a6

SHA512
f57a33b28854855eb00ebdd3b0bc8b644bfbacbad9eb2a66364a662640d237202613ff43348cf405c28f6045855d97ca6928da4fc88906ec47bce2282530d726

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_svchost.exe

Filesize
40KB

MD5
5390ed74a0c3c880fdd6d0e2d135bfe1

SHA1
0dbe542e0fe98e17e877f2e5d1dd6dc252943f41

SHA256
48ca5393cc5f72125e9677a9833e86b4bd65aa4a9c167c6171a2d38359b100d9

SHA512
54699e0c3dba1d2df00aca934264fbf728bc2185024d577f3ce2325a9a04467e5b52d15e5f3a5689fe839afa48175765d55f941879076de8012f4bb84fab9cd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlDuBQDT.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Roaming\Fulloptionnew_by elegance.exe

Filesize
4.0MB

MD5
15dc7dde51858f43e9845f72213c042d

SHA1
b38343e5a2237127be195c758cbd7a403e876a7e

SHA256
f71edea8c4ae6c4c3a44f352e9d6cb89124fea7c7fc48e1585bb11d7bbefd74b

SHA512
322ed64c448e3ad02d83b2c48a2927230647073ffd020aceb4868de8e783b57446a7274099cdf58cf4bf02a125284990b5bc8be20bed548fd7c34354bcf37182

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
793KB

MD5
9f3ee8aef394f4fdb98ead98ec6c1f9b

SHA1
c84a6c4f0a9d0060eacf0a4d5cd46d3955bec846

SHA256
3a6bbe08bb25bb2612f38d254f484e51f69182b3d0fa876660887ed57575a361

SHA512
e5f7a6494c0d53388314dcf8cac5016d7ec7936f1ca91ae4af936749ac164dbd11046dd56e704e03b609e74b9a8698d235c2ca82e9587d610d028f3fa047ead8

Download Submit
memory/1444-130-0x0000000000EF0000-0x0000000000F00000-memory.dmp

Filesize
64KB

Download
memory/1920-37-0x0000000000350000-0x000000000081A000-memory.dmp

Filesize
4.8MB

Download
memory/2232-85-0x0000000000B80000-0x0000000000B90000-memory.dmp

Filesize
64KB

Download
memory/2240-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2704-25-0x0000000000860000-0x0000000000D2A000-memory.dmp

Filesize
4.8MB

Download
memory/2744-122-0x0000000000C50000-0x0000000000C60000-memory.dmp

Filesize
64KB

Download
memory/2756-86-0x0000000000400000-0x00000000009BF000-memory.dmp

Filesize
5.7MB

Download
memory/2756-87-0x0000000000400000-0x00000000009BF000-memory.dmp

Filesize
5.7MB

Download
memory/2756-123-0x0000000000400000-0x00000000009BF000-memory.dmp

Filesize
5.7MB

Download
memory/2888-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2888-26-0x0000000000400000-0x00000000009BF000-memory.dmp

Filesize
5.7MB

Download
memory/2916-57-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3032-60-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download