xred | 6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864

General

Target

6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe
Size

767KB
MD5

0cb593ec7176100fb758a049d63b7f97
SHA1

de06fd4032036df3c7674254f2b16088eacbc1d4
SHA256

6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864
SHA512

cb3d5a1a28a1e2927b1255e7f2eb014dc070cd052e7455daeb7a3ff541f65b254f6bc8ebc0e56de525c197f503607a2dce7bac824b24588d4afc806c84c0e94c
SSDEEP

12288:2MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9vFjhj:2nsJ39LyjbJkQFMhmC+6GD9FJ

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
2508	._cache_6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe
2672	Synaptics.exe
2404	._cache_Synaptics.exe

Loads dropped DLL 5 IoCs

pid	Process
1548	6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe
1548	6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe
1548	6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe
2672	Synaptics.exe
2672	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2568	EXCEL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2568	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2508	1548	6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe	31
PID 1548 wrote to memory of 2508	1548	6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe	31
PID 1548 wrote to memory of 2508	1548	6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe	31
PID 1548 wrote to memory of 2508	1548	6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe	31
PID 1548 wrote to memory of 2672	1548	6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe	33
PID 1548 wrote to memory of 2672	1548	6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe	33
PID 1548 wrote to memory of 2672	1548	6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe	33
PID 1548 wrote to memory of 2672	1548	6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe	33
PID 2672 wrote to memory of 2404	2672	Synaptics.exe	34
PID 2672 wrote to memory of 2404	2672	Synaptics.exe	34
PID 2672 wrote to memory of 2404	2672	Synaptics.exe	34
PID 2672 wrote to memory of 2404	2672	Synaptics.exe	34

C:\Users\Admin\AppData\Local\Temp\6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe
"C:\Users\Admin\AppData\Local\Temp\6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\._cache_6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe"
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    PID:2404

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
767KB

MD5
0cb593ec7176100fb758a049d63b7f97

SHA1
de06fd4032036df3c7674254f2b16088eacbc1d4

SHA256
6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864

SHA512
cb3d5a1a28a1e2927b1255e7f2eb014dc070cd052e7455daeb7a3ff541f65b254f6bc8ebc0e56de525c197f503607a2dce7bac824b24588d4afc806c84c0e94c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Loa1xbfh.xlsm

Filesize
24KB

MD5
385e1ee4933703a302e2e42ae9347a4f

SHA1
f2f37e6db95c6f6d439a1dfa39680c9e852f17c0

SHA256
0234511e2a634030615d65a38b4dfb92995605eff3690f4f2d6b12040c452f05

SHA512
20caa4749e259f3f6e85cb1cca9bb8f49d6c570395553fbd3c064a9589ceae00434a4985b8af00ab6f00321f7d35c603e5d177bbf7acbb41a0ba111917da5761

Download Submit
C:\Users\Admin\AppData\Local\Temp\Loa1xbfh.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Loa1xbfh.xlsm

Filesize
28KB

MD5
c0af1b8c0de38216415fb70d97614f8d

SHA1
93b3bf507d003b881528e6e523848c2f8a811125

SHA256
2bb0e296e377c49f192a319df23173adad735ec3510226ffd81a053297c992cc

SHA512
82762d77d7ae698d2e0d982f9c7cbfe26080ef3343b346cfb1ac09b2765188bfa1f9182177bf743ded58aef5077da00d0b5c37ac8e752816b9723a1150ee4172

Download Submit
C:\Users\Admin\AppData\Local\Temp\Loa1xbfh.xlsm

Filesize
20KB

MD5
938901cc09b802a5eacece1364e98f4f

SHA1
cceaad7342b101487b2fba72d66fb780ed69da82

SHA256
94db2e58662a2eb41caba250cb1957faff64e41529d4df9b88b431959c391cb5

SHA512
d95c4e952bca14f7b2c10af059e426be504ecbe8d07f4de4b2aee13927ebbda594a4810e1080071217951cb6cd515cc53e51fc2f9563b2f349c58c4eec8ee627

Download Submit
C:\Users\Admin\AppData\Local\Temp\Loa1xbfh.xlsm

Filesize
23KB

MD5
39cfaa4dc261b0640778dbd588df0f81

SHA1
a357747b2dc939f7ad4def2a1d43260e60d66f3e

SHA256
22dee28f1e000830612b7ef7efa6a7bfbb98a4a6d262e58e4be4375c871eb0ca

SHA512
7c5204778779ed2c90f7f29565d17a9d2ceda1180d52fa76773c23ff71868c90a32fd43e33a82ce68616412c37c4670fbce5936b15f4c4138954a8391b1754fa

Download Submit
C:\Users\Admin\Documents\~$UsePush.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_6d991e790d34f8cbeb22f32c36765d1f37c71f6af3e1aea8a5e6edb5f76c4864.exe

Filesize
14KB

MD5
9ed7bc5b40b2b6181d42abbc1c65321b

SHA1
a3f0b2250b938b479a1b395a1a627378c863af7a

SHA256
85cdc46a16d03e162b70c8705c5bbced4bd1b76229ee14cd6b1bb85975192f1b

SHA512
3a52a2740459db67b195bdb36896936bf969f890d44b59a84ea45131ffef7d1a2f6cf94ae7b7c8f7e8b463bf64178717aa27693ab83c5309c62c4b0d3c18a30a

Download Submit
memory/1548-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1548-25-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2568-35-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2672-111-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2672-112-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2672-144-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads