xred | 1b92eb0299c15c1edf9a381c2480d29de3fd928337972dd645d66003c5d78604

Resubmissions

14-01-2025 02:37

250114-c4gybstra1 10

14-01-2025 02:36

250114-c32akstqh1 10

Analysis

max time kernel
11s
max time network
0s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
14-01-2025 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

god-potato.exe
Size

814KB
MD5

d85e84021532b8a1724f013672c7964c
SHA1

9802561c9f4dd85dc2b7e2b19da3b27096a96ab6
SHA256

1b92eb0299c15c1edf9a381c2480d29de3fd928337972dd645d66003c5d78604
SHA512

5ac00504fe244f13158f5c5c01c4c0e15f653f2befb2af86e31e7efb8cc4bbe3bd7af50637db926ac83b86dcb17c1fcb12fa4ff43c13f9a86e0f4348effc18a0
SSDEEP

12288:NMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9tfLO4LNzu:NnsJ39LyjbJkQFMhmC+6GD9tLI

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
2064	._cache_god-potato.exe
1144	Synaptics.exe
2940	._cache_Synaptics.exe

Loads dropped DLL 5 IoCs

pid	Process
2312	god-potato.exe
2312	god-potato.exe
2312	god-potato.exe
1144	Synaptics.exe
1144	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	god-potato.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	god-potato.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2064	2312	god-potato.exe	30
PID 2312 wrote to memory of 2064	2312	god-potato.exe	30
PID 2312 wrote to memory of 2064	2312	god-potato.exe	30
PID 2312 wrote to memory of 2064	2312	god-potato.exe	30
PID 2312 wrote to memory of 1144	2312	god-potato.exe	32
PID 2312 wrote to memory of 1144	2312	god-potato.exe	32
PID 2312 wrote to memory of 1144	2312	god-potato.exe	32
PID 2312 wrote to memory of 1144	2312	god-potato.exe	32
PID 1144 wrote to memory of 2940	1144	Synaptics.exe	33
PID 1144 wrote to memory of 2940	1144	Synaptics.exe	33
PID 1144 wrote to memory of 2940	1144	Synaptics.exe	33
PID 1144 wrote to memory of 2940	1144	Synaptics.exe	33

C:\Users\Admin\AppData\Local\Temp\god-potato.exe
"C:\Users\Admin\AppData\Local\Temp\god-potato.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\AppData\Local\Temp\._cache_god-potato.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_god-potato.exe"
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
814KB

MD5
d85e84021532b8a1724f013672c7964c

SHA1
9802561c9f4dd85dc2b7e2b19da3b27096a96ab6

SHA256
1b92eb0299c15c1edf9a381c2480d29de3fd928337972dd645d66003c5d78604

SHA512
5ac00504fe244f13158f5c5c01c4c0e15f653f2befb2af86e31e7efb8cc4bbe3bd7af50637db926ac83b86dcb17c1fcb12fa4ff43c13f9a86e0f4348effc18a0

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_god-potato.exe

Filesize
56KB

MD5
5f3dd0514c98bab7172a4ccb2f7a152d

SHA1
232a0585a7cb6c54e15d5410c96aac5913038e7f

SHA256
3027a212272957298bf4d32505370fa63fb162d6a6a6ec091af9d7626317a858

SHA512
0643bcce6fe676473ebb43d5b2d13fa908bd6c2b291004ccd2cfa53bceb360db39cd9c9373d0856fbc273766c5f3369e4a50d1f9da13dc14f89508763bba2764

Download Submit
memory/1144-36-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/2064-17-0x0000000000B20000-0x0000000000BA0000-memory.dmp

Filesize
512KB

Download
memory/2312-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2312-26-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads