xred | a41dab9a226dea6ed0d4d0673f32d2850b6db46059661587ec252dc60c2c8630

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
Size

5.7MB
MD5

100620cd1016f9b7aed030b8eced2afd
SHA1

f98f52d52fa58ea5d9b179d28422109958e1b3e2
SHA256

457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34
SHA512

b092244989f027692ee5cc4475611469c8ead213dde075493a6f6a5d3b81371d428958617c58a6c16dbadf75cb878fe279c0140f1629a169392e5f14e6c0f08d
SSDEEP

98304:znsmtk2ahd+T6Kn5kBqUMWirt49K9nWBp5doWp/IZviyJrw:LLQdxK3z49K9I5B0vJw

Score

10^/10

xred xworm backdoor discovery macro persistence rat trojan

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

xworm

Version

5.0

45.141.26.134:7000

Mutex

CcojtGUool4u0Nw2

Attributes

Install_directory
%Userprofile%
install_file
svchost.exe

aes.plain

Signatures

Detect Xworm Payload 7 IoCs

resource	yara_rule
behavioral1/files/0x0006000000016d3a-101.dat	family_xworm
behavioral1/files/0x0006000000016d43-138.dat	family_xworm
behavioral1/memory/2508-139-0x0000000000BD0000-0x0000000000BE0000-memory.dmp	family_xworm
behavioral1/memory/2080-136-0x0000000000400000-0x00000000004CC000-memory.dmp	family_xworm
behavioral1/memory/1820-146-0x0000000000370000-0x0000000000380000-memory.dmp	family_xworm
behavioral1/memory/284-181-0x0000000000080000-0x0000000000090000-memory.dmp	family_xworm
behavioral1/memory/2464-189-0x00000000001A0000-0x00000000001B0000-memory.dmp	family_xworm

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Suspicious Office macro 3 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x0009000000016c88-72.dat
behavioral1/files/0x0007000000016cd7-87.dat
behavioral1/files/0x0009000000016cd7-123.dat

Executes dropped EXE 9 IoCs

pid	Process
688	._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
2480	Synaptics.exe
2992	._cache_Synaptics.exe
1744	Fulloptionnew_by elegance.exe
2080	svchost.exe
2508	._cache_svchost.exe
1820	svchost.exe
284	svchost.exe
2464	svchost.exe

Loads dropped DLL 8 IoCs

pid	Process
3036	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
3036	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
3036	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
2480	Synaptics.exe
2480	Synaptics.exe
2992	._cache_Synaptics.exe
2080	svchost.exe
2080	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\svchost.exe"	._cache_svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2576	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2968	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2508	._cache_svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	._cache_svchost.exe
Token: SeDebugPrivilege	2508	._cache_svchost.exe
Token: SeDebugPrivilege	1820	svchost.exe
Token: SeDebugPrivilege	284	svchost.exe
Token: SeDebugPrivilege	2464	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2968	EXCEL.EXE
2508	._cache_svchost.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 688	3036	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	30
PID 3036 wrote to memory of 688	3036	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	30
PID 3036 wrote to memory of 688	3036	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	30
PID 3036 wrote to memory of 688	3036	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	30
PID 3036 wrote to memory of 2480	3036	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	31
PID 3036 wrote to memory of 2480	3036	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	31
PID 3036 wrote to memory of 2480	3036	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	31
PID 3036 wrote to memory of 2480	3036	457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe	31
PID 2480 wrote to memory of 2992	2480	Synaptics.exe	32
PID 2480 wrote to memory of 2992	2480	Synaptics.exe	32
PID 2480 wrote to memory of 2992	2480	Synaptics.exe	32
PID 2480 wrote to memory of 2992	2480	Synaptics.exe	32
PID 2992 wrote to memory of 1744	2992	._cache_Synaptics.exe	34
PID 2992 wrote to memory of 1744	2992	._cache_Synaptics.exe	34
PID 2992 wrote to memory of 1744	2992	._cache_Synaptics.exe	34
PID 2992 wrote to memory of 2080	2992	._cache_Synaptics.exe	35
PID 2992 wrote to memory of 2080	2992	._cache_Synaptics.exe	35
PID 2992 wrote to memory of 2080	2992	._cache_Synaptics.exe	35
PID 2992 wrote to memory of 2080	2992	._cache_Synaptics.exe	35
PID 2080 wrote to memory of 2508	2080	svchost.exe	36
PID 2080 wrote to memory of 2508	2080	svchost.exe	36
PID 2080 wrote to memory of 2508	2080	svchost.exe	36
PID 2080 wrote to memory of 2508	2080	svchost.exe	36
PID 2508 wrote to memory of 2576	2508	._cache_svchost.exe	41
PID 2508 wrote to memory of 2576	2508	._cache_svchost.exe	41
PID 2508 wrote to memory of 2576	2508	._cache_svchost.exe	41
PID 352 wrote to memory of 1820	352	taskeng.exe	44
PID 352 wrote to memory of 1820	352	taskeng.exe	44
PID 352 wrote to memory of 1820	352	taskeng.exe	44
PID 352 wrote to memory of 284	352	taskeng.exe	45
PID 352 wrote to memory of 284	352	taskeng.exe	45
PID 352 wrote to memory of 284	352	taskeng.exe	45
PID 352 wrote to memory of 2464	352	taskeng.exe	46
PID 352 wrote to memory of 2464	352	taskeng.exe	46
PID 352 wrote to memory of 2464	352	taskeng.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
"C:\Users\Admin\AppData\Local\Temp\457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe"
  2⤵
  - Executes dropped EXE
  PID:688
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Users\Admin\AppData\Roaming\Fulloptionnew_by elegance.exe
      "C:\Users\Admin\AppData\Roaming\Fulloptionnew_by elegance.exe"
      4⤵
      Executes dropped EXE
      PID:1744
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\._cache_svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_svchost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2508
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\svchost.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2576

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2968

C:\Windows\system32\taskeng.exe
taskeng.exe {FBD621C8-1261-4545-8ACC-8E515FEE9DA5} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:352
- C:\Users\Admin\svchost.exe
  C:\Users\Admin\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1820
- C:\Users\Admin\svchost.exe
  C:\Users\Admin\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:284
- C:\Users\Admin\svchost.exe
  C:\Users\Admin\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
5.7MB

MD5
100620cd1016f9b7aed030b8eced2afd

SHA1
f98f52d52fa58ea5d9b179d28422109958e1b3e2

SHA256
457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34

SHA512
b092244989f027692ee5cc4475611469c8ead213dde075493a6f6a5d3b81371d428958617c58a6c16dbadf75cb878fe279c0140f1629a169392e5f14e6c0f08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_svchost.exe

Filesize
40KB

MD5
5390ed74a0c3c880fdd6d0e2d135bfe1

SHA1
0dbe542e0fe98e17e877f2e5d1dd6dc252943f41

SHA256
48ca5393cc5f72125e9677a9833e86b4bd65aa4a9c167c6171a2d38359b100d9

SHA512
54699e0c3dba1d2df00aca934264fbf728bc2185024d577f3ce2325a9a04467e5b52d15e5f3a5689fe839afa48175765d55f941879076de8012f4bb84fab9cd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\pQNulmAV.xlsm

Filesize
30KB

MD5
945d3f9a6863626c89b74d233c7889ed

SHA1
7b4a558104dae517f10ff7bd2d062f52c7d8e3e5

SHA256
6e44dcf4ea09fbf7b00ee034033181070cf12411f1edb9c314d746f9b75510dd

SHA512
f115f1ab119d7b7c46844f2a92ed943f3eda28c9cf61b65651996bd44493df98b695e03f899570f5720c5d63777d3cb91474a81699b32b6a662995682fba3668

Download Submit
C:\Users\Admin\AppData\Local\Temp\pQNulmAV.xlsm

Filesize
29KB

MD5
5618560f87ee3632104aef94bd7fb950

SHA1
833ed1f5d439bfe7d1f1ccdc815de8a1ba03083a

SHA256
2f4bcd16199e4ce940a0c610837f45e704b9b0c40b9f10a335573f1f676fad55

SHA512
031f2fc595b417a7ce038b28c58a497d95c9ef798edc0b12e911359b3baf587881ac57005f9a1e6e2f749911becf3ff925a20eb91504ad10385f8ada761c3254

Download Submit
C:\Users\Admin\AppData\Local\Temp\pQNulmAV.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\pQNulmAV.xlsm

Filesize
23KB

MD5
fd0075a80fa08d506a3ba8ca59bb731e

SHA1
22a9c866e27b90abc3874d8150f6bf8d6da784fb

SHA256
cbecaf1df366840c10fac46651db44ddeeb39fde1277afb50b97c2d134023e00

SHA512
4d705e7ac8f095584389753c9748f481d15eb4048b1e050aee872c14135ce9c4ac4fee2c211cca40478ec4032da53be9b49b915233a41acb2d1acad8f159838a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pQNulmAV.xlsm

Filesize
27KB

MD5
116b625f54f7f0aba243943934f0ac13

SHA1
fddf6233d2e284f047cdd277e4f0655d133b695c

SHA256
7318099cdcc992f65dc7308b23f30f904342cd6b3598a86ff7bba2e2a1158f30

SHA512
39f748fd4795bd5768324185b609464b5ffc167e4af28a88c32f71379817a21c5cb5f0043dd34a8e3157ff6bc4dd5d9c5d419d9ac6b5f4a228d0b371f178f429

Download Submit
C:\Users\Admin\AppData\Roaming\Fulloptionnew_by elegance.exe

Filesize
4.0MB

MD5
15dc7dde51858f43e9845f72213c042d

SHA1
b38343e5a2237127be195c758cbd7a403e876a7e

SHA256
f71edea8c4ae6c4c3a44f352e9d6cb89124fea7c7fc48e1585bb11d7bbefd74b

SHA512
322ed64c448e3ad02d83b2c48a2927230647073ffd020aceb4868de8e783b57446a7274099cdf58cf4bf02a125284990b5bc8be20bed548fd7c34354bcf37182

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
793KB

MD5
9f3ee8aef394f4fdb98ead98ec6c1f9b

SHA1
c84a6c4f0a9d0060eacf0a4d5cd46d3955bec846

SHA256
3a6bbe08bb25bb2612f38d254f484e51f69182b3d0fa876660887ed57575a361

SHA512
e5f7a6494c0d53388314dcf8cac5016d7ec7936f1ca91ae4af936749ac164dbd11046dd56e704e03b609e74b9a8698d235c2ca82e9587d610d028f3fa047ead8

Download Submit
C:\Users\Admin\Downloads\~$RegisterLock.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_457a62394c53eba3c5ef6d569230487c17aaabc837a4a9361670b1c2ee9f5c34.exe

Filesize
4.8MB

MD5
adc3667c6060dfdcb6f41bd2b01c31a3

SHA1
54c39168b2d76c54f62f9ba266754581ff599d2d

SHA256
bab41ee900b96a6c768996d935ba44c391c14003c30a278a8ac1e32ebe49a1a6

SHA512
f57a33b28854855eb00ebdd3b0bc8b644bfbacbad9eb2a66364a662640d237202613ff43348cf405c28f6045855d97ca6928da4fc88906ec47bce2282530d726

Download Submit
memory/284-181-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/688-28-0x0000000000C90000-0x000000000115A000-memory.dmp

Filesize
4.8MB

Download
memory/1820-146-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/2080-136-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2464-189-0x00000000001A0000-0x00000000001B0000-memory.dmp

Filesize
64KB

Download
memory/2480-141-0x0000000000400000-0x00000000009BF000-memory.dmp

Filesize
5.7MB

Download
memory/2480-142-0x0000000000400000-0x00000000009BF000-memory.dmp

Filesize
5.7MB

Download
memory/2480-178-0x0000000000400000-0x00000000009BF000-memory.dmp

Filesize
5.7MB

Download
memory/2508-139-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

Filesize
64KB

Download
memory/2968-36-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2992-37-0x0000000000DB0000-0x000000000127A000-memory.dmp

Filesize
4.8MB

Download
memory/3036-0-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/3036-25-0x0000000000400000-0x00000000009BF000-memory.dmp

Filesize
5.7MB

Download