xred | 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3

Analysis

max time kernel
113s
max time network
106s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/01/2025, 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
Size

1.1MB
MD5

4c886cdaccdf919d6247ebc54caa8b29
SHA1

86872c1e8c766090406ef896342e4c9d67eea077
SHA256

93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3
SHA512

b7f8937bdecf21e3d928febc4ad446c7adc416fc209a2e9f3c8dd88fcfe6bc2dbb10a9b51c5d9e9d181be398fbd4f47c09d40a5873f565020fb6fdb92b1b7345
SSDEEP

12288:tMSApJVYG5lDLyjsb0eOzkv4R7Qnvt35+6G75V9FxKewO79X+27RAlJx8Eportv:tnsJ39LyjbJkQFMn+6GD93AlJx8EporJ

Score

10^/10

xred backdoor discovery macro persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x000600000001a061-108.dat

Executes dropped EXE 3 IoCs

pid	Process
2332	._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
2480	Synaptics.exe
2780	._cache_Synaptics.exe

Loads dropped DLL 5 IoCs

pid	Process
2356	93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
2356	93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
2356	93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
2480	Synaptics.exe
2480	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2740	EXCEL.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2332	._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2740	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2332	2356	93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe	30
PID 2356 wrote to memory of 2332	2356	93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe	30
PID 2356 wrote to memory of 2332	2356	93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe	30
PID 2356 wrote to memory of 2332	2356	93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe	30
PID 2356 wrote to memory of 2480	2356	93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe	31
PID 2356 wrote to memory of 2480	2356	93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe	31
PID 2356 wrote to memory of 2480	2356	93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe	31
PID 2356 wrote to memory of 2480	2356	93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe	31
PID 2480 wrote to memory of 2780	2480	Synaptics.exe	32
PID 2480 wrote to memory of 2780	2480	Synaptics.exe	32
PID 2480 wrote to memory of 2780	2480	Synaptics.exe	32
PID 2480 wrote to memory of 2780	2480	Synaptics.exe	32

C:\Users\Admin\AppData\Local\Temp\93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
"C:\Users\Admin\AppData\Local\Temp\93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2332
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2780

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.1MB

MD5
4c886cdaccdf919d6247ebc54caa8b29

SHA1
86872c1e8c766090406ef896342e4c9d67eea077

SHA256
93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3

SHA512
b7f8937bdecf21e3d928febc4ad446c7adc416fc209a2e9f3c8dd88fcfe6bc2dbb10a9b51c5d9e9d181be398fbd4f47c09d40a5873f565020fb6fdb92b1b7345

Download Submit
C:\Users\Admin\AppData\Local\Temp\VBQtTq1H.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\VBQtTq1H.xlsm

Filesize
27KB

MD5
b71e3109b18bb688e0ac26347e32cbc0

SHA1
fbb5fde5c8def5f1af3ccd4c726955f5e369a5fd

SHA256
ad8fdf968850e6e512a83b53426d20de76a9b6741166b26db2eaca4f92802328

SHA512
89b554e6f1be7f476442595ebb9545cd19e374e7e2a4599b113c90c5c8b841948b0bf660d36113f9278f466fad14f0b29c3e3355fa229f2260b6c0bd38dccaa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\VBQtTq1H.xlsm

Filesize
23KB

MD5
7ca77f5de769b38825d5094f593a4847

SHA1
425f0197cf0bc4f00e31d6b31a477657079db4d2

SHA256
78c23f2fe9db193f768cd69fe341500a11edb953e46a3ce2201e5196123b7969

SHA512
98905389e0d9b0cf1a24035b1046f2118daf23a24a4be238b6bc6b04f2af89ec1a0c40d72c3f8e3040e8caa3ef8b67a74d49c3f67a74da66a3a93db7b19493eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\VBQtTq1H.xlsm

Filesize
24KB

MD5
20172db3cd30fcc40d7b1c6080506756

SHA1
8d9d1f2f4f825a42b67c92e202aa9573e62ca377

SHA256
7880acf114ee46649bba6837fbacf6341a7abda14e6ff50e58d6421ee646417c

SHA512
9aded587b538d566ea3187f294aa772f737fe7dd0171eaadf5c800a1fc0af8b77145e4ef345966e783a8e37438bf2ada6fbe1172596c21927549c253e7889dd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\VBQtTq1H.xlsm

Filesize
25KB

MD5
e551e717309d5bc4595d75d95337f511

SHA1
2645bbb7058c4862e29860b010bca30012e4d0e9

SHA256
5cefd261cc23b32147187482859858db676a9c9c28b908ac615075d1460445e3

SHA512
9b787ad1b4dc4ca24471fa5f1c8130ddf3abee9c4e8a478ca93e4b35e1cdf53502b825fc1ffdb8ffb45104d82047d0ced824fb13950ae26fa8a06b27d7874b6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\VBQtTq1H.xlsm

Filesize
28KB

MD5
929a64beec93541ab940e71d009254e3

SHA1
976a99dd6a360181f2bf74fe849ec4527786f210

SHA256
d394bd279b9967fc4ff7d9ee1f39a9e7443e95f19a70b945338b860b32348ea2

SHA512
bd540058e999125dcb0b69fada8ea016c246896c2aff129fc61e1c956ab4bed9e7c3187ade34d87144e46021694c2e43aee77c15b26ca181fd89c94276433c44

Download Submit
C:\Users\Admin\Desktop\~$StepInitialize.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe

Filesize
333KB

MD5
c6377c648ac8775fcc8302c1db14a8aa

SHA1
2b5faa68d1c9ff2572210a6420b39e9b2d4394c9

SHA256
df6589654abfacb1490a9f19e9c0e32623e73f2a1b852e8a8379b7873d03a33a

SHA512
dfb7ea7eb049847f0ebebbd74b4fe39b464b61ca0cb161186f5a40cb8e96978f73df200ce43b0e69a8707150f2026d6171109dbd60cb498aa74465e9d96e909f

Download Submit
memory/2356-25-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/2356-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2480-35-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/2480-127-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/2480-128-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/2480-160-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/2740-36-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads