Analysis

  • max time kernel
    111s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-01-2025 03:34

General

  • Target

    45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe

  • Size

    759KB

  • MD5

    f942e3805f405407247d09a99145966f

  • SHA1

    8660e9f35751c8ad24c7be53a77b2a2318d6eba4

  • SHA256

    45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176

  • SHA512

    a03d6953f0077f17a766c32dfb1d75747108d401a34458dec59858f3bfacd6fde92fe174faff82937fb3578b15603f4899c1039a766495be40d9f1ab62dacc45

  • SSDEEP

    12288:SMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9YQh:SnsJ39LyjbJkQFMhmC+6GD99

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 11 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe
    "C:\Users\Admin\AppData\Local\Temp\45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\AppData\Local\Temp\._cache_45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2820
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        dw20.exe -x -s 396
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2716
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2208
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
          dw20.exe -x -s 388
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1784
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2188

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    759KB

    MD5

    f942e3805f405407247d09a99145966f

    SHA1

    8660e9f35751c8ad24c7be53a77b2a2318d6eba4

    SHA256

    45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176

    SHA512

    a03d6953f0077f17a766c32dfb1d75747108d401a34458dec59858f3bfacd6fde92fe174faff82937fb3578b15603f4899c1039a766495be40d9f1ab62dacc45

  • C:\Users\Admin\AppData\Local\Temp\56DyLKWF.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\56DyLKWF.xlsm

    Filesize

    24KB

    MD5

    089491de37bf26013fc6219dcca0a7f5

    SHA1

    f2bb246d990926bdb485e58736efdd138f339036

    SHA256

    d210662c2830ad2d86e7601d35dd15fba8df9586908194adcebd398e0897cc49

    SHA512

    75e2ca5147c4003997ca8c81ab117f336843017dd2f11ea40d621ac4c19239f3b925e42a54227903f8d01ba68d48b98c9caf8617a0f33c0aea19dded9d3852f5

  • C:\Users\Admin\AppData\Local\Temp\56DyLKWF.xlsm

    Filesize

    23KB

    MD5

    27047eea9a62dca9b26301b7224896a6

    SHA1

    9a0aa88f729f1ae99a03d31242601b2a7abf0ed7

    SHA256

    61b07c5b3a74f83220a5a03805caf059e24b0a61a7811782a8dd1d7bc7f57045

    SHA512

    5f5b81caa696db8d5b6dd2b4c56e65df09fd2fa0def53472d70e19a96d74a275d82ebd3d4b66705ed6a7e73a4585adff76e0ac4c11014f55ea52ab5569ef5d42

  • C:\Users\Admin\AppData\Local\Temp\56DyLKWF.xlsm

    Filesize

    26KB

    MD5

    831659cb6a1cd3bf9280656de1d43ce2

    SHA1

    4bccaab2cfff88410c83d506f5576f9c16364203

    SHA256

    e69289f7b3d95bb52c8943eb1359d707363a5ee5b56f7f8759f9d1dc391954dd

    SHA512

    eb27b41660f53d112448c1fc347e00dd539c5fcd09cae4558ebbeedf3911aabeb0316a9d907919100fddc2ed9c438a2646c00d40b35990e0d1f989cd872cec98

  • \Users\Admin\AppData\Local\Temp\._cache_45f808fc84e93b85b304f9be71e20c18aba7d870a0a8c09d770715f0733bf176.exe

    Filesize

    5KB

    MD5

    7cf8491bc5ac58184cd684d1a088340a

    SHA1

    ba61e1cad1c0187933213843001f75e2bb0259a9

    SHA256

    7d261f5c5051519a5c0cf53e21e095e7e6984b16fa8929f0edbe8213f8441f8f

    SHA512

    c42c355560ab5343f53ca46c50e3ae1803301920a5ce6d3ce991c457c8753595cb21bdfa1be205191eb4fef290bed15feaf0c3d16f0c040abed05f41d9a97d1b

  • memory/2188-110-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2188-44-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2316-27-0x0000000000400000-0x00000000004C4000-memory.dmp

    Filesize

    784KB

  • memory/2316-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2792-112-0x0000000000400000-0x00000000004C4000-memory.dmp

    Filesize

    784KB

  • memory/2792-113-0x0000000000400000-0x00000000004C4000-memory.dmp

    Filesize

    784KB

  • memory/2792-148-0x0000000000400000-0x00000000004C4000-memory.dmp

    Filesize

    784KB

  • memory/2820-30-0x0000000073530000-0x0000000073ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/2820-18-0x0000000073531000-0x0000000073532000-memory.dmp

    Filesize

    4KB

  • memory/2820-111-0x0000000073530000-0x0000000073ADB000-memory.dmp

    Filesize

    5.7MB

  • memory/2820-114-0x0000000073530000-0x0000000073ADB000-memory.dmp

    Filesize

    5.7MB