Analysis
- max time kernel
144s - max time network
160s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
- submitted
21/02/2025, 14:59
General
- Target bluewing TS/BlueWing Cleaner.exe
- Size 1.2MB
- Sample250221-sc4wsawks7
- SHA256 2fdc67ad98fe3cd9e7f1f2b7b67509b3870914aa7989cc097a99bcdf7dc6574d
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Xred
Xred is backdoor written in Delphi.
- Xred family
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies system certificate store 2 TTPs 4 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bluewing TS\BlueWing Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\bluewing TS\BlueWing Cleaner.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bluewing TS\._cache_BlueWing Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\bluewing TS\._cache_BlueWing Cleaner.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bluewing TS\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\bluewing TS\._cache_Synaptics.exe" InjUpdate3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
Synaptics.exe
Cv5yg968.xlsm
Cv5yg968.xlsm
._cache_BlueWing Cleaner.exe
memory/1704-0-0x0000000000220000-0x0000000000221000-memory.dmp
memory/1704-27-0x0000000000400000-0x0000000000540000-memory.dmp
memory/2476-18-0x00000000734CE000-0x00000000734CF000-memory.dmp
memory/2476-31-0x00000000002F0000-0x0000000000332000-memory.dmp
memory/2476-28-0x0000000000CF0000-0x0000000000D7A000-memory.dmp
memory/2476-88-0x00000000734CE000-0x00000000734CF000-memory.dmp
memory/2492-41-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2660-40-0x0000000000C30000-0x0000000000CBA000-memory.dmp
memory/2960-87-0x0000000000400000-0x0000000000540000-memory.dmp
memory/2960-90-0x0000000000400000-0x0000000000540000-memory.dmp
memory/2960-124-0x0000000000400000-0x0000000000540000-memory.dmp