Analysis
-
max time kernel
3s -
max time network
15s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
02-02-2025 10:10
General
-
Target
BotKiller.exe
-
Size
847KB
-
MD5
caaac4b109395cf9e72dea781367c82a
-
SHA1
3bd04b445f48e6f6ed454af71f10aa4c43eca7e4
-
SHA256
493c2a15384d4250616c46e1aa92963e966de91b11a2366c1777baac929cd087
-
SHA512
9835332f7a6bede6c575c3f2b55a438abea96530aa82a524a508deac58a9f514b0ec7b4572ecb56de348cc3fd30ccc7e2781f4a47f507a2b4ff85cffcb69df3d
-
SSDEEP
12288:NMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9/x3sAGfOge:NnsJ39LyjbJkQFMhmC+6GD9pymF
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Suspicious Office macro 1 IoCs
Office document equipped with macros.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BotKiller.exe"C:\Users\Admin\AppData\Local\Temp\BotKiller.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_BotKiller.exe"C:\Users\Admin\AppData\Local\Temp\._cache_BotKiller.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2cc 0x4141⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
847KB
MD5caaac4b109395cf9e72dea781367c82a
SHA13bd04b445f48e6f6ed454af71f10aa4c43eca7e4
SHA256493c2a15384d4250616c46e1aa92963e966de91b11a2366c1777baac929cd087
SHA5129835332f7a6bede6c575c3f2b55a438abea96530aa82a524a508deac58a9f514b0ec7b4572ecb56de348cc3fd30ccc7e2781f4a47f507a2b4ff85cffcb69df3d
-
Filesize
16KB
MD59aca7216606768d5b770f824c5061f43
SHA150e0719242f2d510777c33084c4e5ead44462022
SHA2569164474d078c7ac011bcf384834669871095e6c3de6d722b42863765171a1208
SHA5126139f7dcec76f1c872f843f1cfde47f71e498be4168df871fa5df28016d89c24226f588eebfd9ebfd0c001e5439f450b25e964d065b1dfa90faad8aeecdfd339
-
Filesize
20KB
MD544a50f70f311522334f280be9fd231ee
SHA1be272e09af7c61fae1aad4ce7e9e0b7f5352d02d
SHA2569ffbc9feff9327297e15aa0274924e071b971448e15fead4c4e86c3825f39d7e
SHA512dfa2307480df175ea19e99e9440d94d17f6db4f4f98ee6e842ec73970ac281863e36a1e2742c265565422f6f069c36bc8f1e0af6ecd1d1f413abf3d37cf9d0d3
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
76KB
-
Filesize
53.7MB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
4KB
-
Filesize
872KB
-
Filesize
4.2MB
-
Filesize
132KB
-
Filesize
68KB
-
Filesize
36KB
-
Filesize
104KB
-
Filesize
780KB
-
Filesize
840KB
-
Filesize
28KB
-
Filesize
72KB
-
Filesize
576KB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
10.6MB
-
Filesize
872KB
-
Filesize
832KB
-
Filesize
876KB
-
Filesize
76KB
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
112KB
-
Filesize
68KB
-
Filesize
124KB
-
Filesize
944KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
872KB