xred | f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/01/2025, 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
Size

1.5MB
MD5

2756afc3782b185d3c05dd880a8e8313
SHA1

82417bd86f1fb249e296bb6b073b560e47639dde
SHA256

f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682
SHA512

9ffea594cd493cbd6fcb9f6f63dffa9127b17487177e63a466b786bc2d24d8af270c56dc653720266e6ad410ddce0931423354b6fa2dc02a7b2cb91e42321fc2
SSDEEP

24576:WnsJ39LyjbJkQFMhmC+6GD9+wfLrvi4cRIyDe3SUNaXy+WypoGHgQ:WnsHyjtk2MYC5GDf+i3DsX1WH5Q

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
2188	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
2236	Synaptics.exe
2844	._cache_Synaptics.exe

Loads dropped DLL 21 IoCs

pid	Process
1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
2236	Synaptics.exe
2236	Synaptics.exe
2844	._cache_Synaptics.exe
2844	._cache_Synaptics.exe
2188	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
2188	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
2844	._cache_Synaptics.exe
2844	._cache_Synaptics.exe
2844	._cache_Synaptics.exe
2844	._cache_Synaptics.exe
2188	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
2188	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
2844	._cache_Synaptics.exe
2844	._cache_Synaptics.exe
2188	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
2188	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
2844	._cache_Synaptics.exe
2844	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wrap_oal.new	._cache_Synaptics.exe
File created	C:\Windows\system32\OpenAL32.new	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
File opened for modification	C:\Windows\SysWOW64\tmp1097.tmp	._cache_Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\tmp1098.tmp	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
File opened for modification	C:\Windows\SysWOW64\OpenAL32.new	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
File opened for modification	C:\Windows\system32\OpenAL32.new	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
File opened for modification	C:\Windows\SysWOW64\tmpF824.tmp	._cache_Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\tmpF827.tmp	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
File created	C:\Windows\SysWOW64\OpenAL32.new	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
File opened for modification	C:\Windows\SysWOW64\tmp1086.tmp	._cache_Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\tmpF825.tmp	._cache_Synaptics.exe
File created	C:\Windows\SysWOW64\wrap_oal.new	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
File opened for modification	C:\Windows\SysWOW64\wrap_oal.new	._cache_Synaptics.exe
File created	C:\Windows\system32\wrap_oal.new	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
File opened for modification	C:\Windows\SysWOW64\tmp1096.tmp	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
File created	C:\Windows\SysWOW64\OpenAL32.new	._cache_Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\tmpF826.tmp	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
File created	C:\Windows\system32\OpenAL32.new	._cache_Synaptics.exe
File opened for modification	C:\Windows\system32\wrap_oal.new	._cache_Synaptics.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\OpenAL\._cache_Synaptics.exe	._cache_Synaptics.exe
File created	C:\Program Files (x86)\OpenAL\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
File opened for modification	C:\Program Files (x86)\OpenAL\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
File opened for modification	C:\Program Files (x86)\OpenAL\._cache_Synaptics.exe	._cache_Synaptics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1292	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1292	EXCEL.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2188	1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe	31
PID 1044 wrote to memory of 2188	1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe	31
PID 1044 wrote to memory of 2188	1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe	31
PID 1044 wrote to memory of 2188	1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe	31
PID 1044 wrote to memory of 2188	1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe	31
PID 1044 wrote to memory of 2188	1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe	31
PID 1044 wrote to memory of 2188	1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe	31
PID 1044 wrote to memory of 2236	1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe	32
PID 1044 wrote to memory of 2236	1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe	32
PID 1044 wrote to memory of 2236	1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe	32
PID 1044 wrote to memory of 2236	1044	f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe	32
PID 2236 wrote to memory of 2844	2236	Synaptics.exe	33
PID 2236 wrote to memory of 2844	2236	Synaptics.exe	33
PID 2236 wrote to memory of 2844	2236	Synaptics.exe	33
PID 2236 wrote to memory of 2844	2236	Synaptics.exe	33
PID 2236 wrote to memory of 2844	2236	Synaptics.exe	33
PID 2236 wrote to memory of 2844	2236	Synaptics.exe	33
PID 2236 wrote to memory of 2844	2236	Synaptics.exe	33

C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
"C:\Users\Admin\AppData\Local\Temp\f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2188
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:2844

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
2756afc3782b185d3c05dd880a8e8313

SHA1
82417bd86f1fb249e296bb6b073b560e47639dde

SHA256
f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682

SHA512
9ffea594cd493cbd6fcb9f6f63dffa9127b17487177e63a466b786bc2d24d8af270c56dc653720266e6ad410ddce0931423354b6fa2dc02a7b2cb91e42321fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\uiSPUA3r.xlsm

Filesize
20KB

MD5
83d42837e90ff7448c03667abfa16f0f

SHA1
95364e28682983fd33d2eef6d9f5dfba0a9c1f0f

SHA256
a820e62b0af767fd6e2a0fce99d96a4145a5580ab87ff0658f81a34523468c12

SHA512
c36e6c5973e692a423870f493aa3b6b6dc50ca0bef195305d74d125046c203f60efcd92fe4d2801eb94c6f3dd705f54269198ffd48f7fe293e030f526cbb5952

Download Submit
C:\Users\Admin\AppData\Local\Temp\uiSPUA3r.xlsm

Filesize
24KB

MD5
6d6e3aa762a418992452a1d4bb22ad9a

SHA1
deb6997c7df4712128c01a998519eaabcf94114d

SHA256
b8b431aeae80e61078e94c8ee7911c927279e2fc2e962eaf50020675730b0f29

SHA512
7d37051266d577127e37e2052aa1d55e6566468e9a86a26822d88ba5cfefc8464cd82770cd6e35b45202da193c806dda75ead0519475b6dd97c3714b641d56c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\uiSPUA3r.xlsm

Filesize
23KB

MD5
bdba097c25dfec639767390de30aca92

SHA1
4770ea7d483ef5eabb3a8b419063d508502e9f95

SHA256
afd69e701b6aaed1082bcd78fad105c0a789932f2a8eca6c96a600b3fb58908d

SHA512
03790c24dd8100eedac95064a5e77e4a58c384d8bea47a788bad0858aeaad0308c8be7260d0472dfc445ebdeaef153e71ac91e6d46379d744b733dd4c0841142

Download Submit
C:\Users\Admin\AppData\Local\Temp\uiSPUA3r.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\uiSPUA3r.xlsm

Filesize
23KB

MD5
1b325be293990a33879ecbcfbe49fcd5

SHA1
2f01f577fdb0f9fe3bd96d9fd4b86565b867a7fd

SHA256
2066e0e22da27893acf088db81fd7ee5caa3a083e16fcb66ac0938dfb53fce85

SHA512
4b59ba5ed9c655684509bc743ad3846c7f2282bc7d84fa27b1887fab66dd88515163b85ee71bef1eb598e24e7740651d47663dff7c3f1d7dd56e7be426a6aa7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\~$uiSPUA3r.xlsm

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
C:\Windows\system32\wrap_oal.new

Filesize
455KB

MD5
549347bcd4aacd63243d78e8f869dbb1

SHA1
efc00d2a7c5acfe17b8a58023826e6840aef39a6

SHA256
5379373cf3eff41cdd8c912c65e27e1bd492bd84238d19a093aa846c9b1ce909

SHA512
c6789376d05deb8c5050225c37c023055c107a72b49afddfd3f91e7e7429d38db9346e2e5d38986c2000c3828389cfbe5d74d80423a79eebd0367bcc81137cd5

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_f05b2555733c2ae2ee5a39c1e7b7a833c0bbae64a020c42a5446274a2545d682.exe

Filesize
790KB

MD5
694f54bd227916b89fc3eb1db53f0685

SHA1
21fdc367291bbef14dac27925cae698d3928eead

SHA256
b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd

SHA512
55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5

Download Submit
\Windows\SysWOW64\OpenAL32.new

Filesize
106KB

MD5
235355a8dd26903e75d5e812ecf50e53

SHA1
8316319341a0f9054e19e4a7b21df3dc49386fee

SHA256
1797d150a2e23af4f390f5c33eb598c6f58d0454011d74941f5316add900bbdd

SHA512
5beb9343028790f993d0acb1007fd112b7e2ef6f9fbedfdb62b0140d2bbadf3b6368417ea19edb0bc8674d19418e5784fef4430ce1c329de8e83c304706d39ac

Download Submit
\Windows\SysWOW64\wrap_oal.new

Filesize
434KB

MD5
d494267bc169604fac5e3679b9a97fed

SHA1
c093ce5a4f7dc40f7f604945bd1facfb2c805c4b

SHA256
a4e46e6d09c4b0966824a2f6628ebf738e813672692a52a0d63d982e1030ef4f

SHA512
7cfcfb570ecfa974054b5285c7d6ad3bccf502866ea70789750c3748394cb0991d1fa6dec9c50a506dbc697953663ec2605277a4451098bb8cd6699c4e506040

Download Submit
\Windows\System32\OpenAL32.new

Filesize
120KB

MD5
2ad7b4f3c8d2bb686d231edff404b7a4

SHA1
f29676b96d04bd2765925a3834d9babfdce6a0b3

SHA256
87802322c8e63555c26fe473ce234ce7099745ccb28c02766c2224c726454039

SHA512
51a6c8cfe30e34c37437e6c5f8c602aa0759b65559a82521e2dbcf8a9865b826077854acb6497df6085d67b4c66083ae5f0f192b743a4b6f77ce7b18f01bf528

Download Submit
memory/1044-25-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/1044-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1292-101-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1292-177-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2236-67-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/2236-178-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/2236-179-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/2236-211-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads