Analysis
- max time kernel
147s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
21/02/2025, 14:59
General
- Target bluewing TS/BlueWing Cleaner.exe
- Size 1.2MB
- Sample250221-sc4wsawks7
- SHA256 2fdc67ad98fe3cd9e7f1f2b7b67509b3870914aa7989cc097a99bcdf7dc6574d
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Xred
Xred is backdoor written in Delphi.
- Xred family
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bluewing TS\BlueWing Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\bluewing TS\BlueWing Cleaner.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bluewing TS\._cache_BlueWing Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\bluewing TS\._cache_BlueWing Cleaner.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bluewing TS\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\bluewing TS\._cache_Synaptics.exe" InjUpdate3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
Synaptics.exe
._cache_BlueWing Cleaner.exe
wmwchIFo.xlsm
wmwchIFo.xlsm
memory/1316-212-0x00007FFF02190000-0x00007FFF021A0000-memory.dmp
memory/1316-213-0x00007FFF02190000-0x00007FFF021A0000-memory.dmp
memory/1316-211-0x00007FFF02190000-0x00007FFF021A0000-memory.dmp
memory/1316-210-0x00007FFF02190000-0x00007FFF021A0000-memory.dmp
memory/1316-209-0x00007FFF02190000-0x00007FFF021A0000-memory.dmp
memory/1316-214-0x00007FFEFFB90000-0x00007FFEFFBA0000-memory.dmp
memory/1316-215-0x00007FFEFFB90000-0x00007FFEFFBA0000-memory.dmp
memory/2444-291-0x0000000000400000-0x0000000000540000-memory.dmp
memory/2444-130-0x0000000002190000-0x0000000002191000-memory.dmp
memory/2444-260-0x0000000000400000-0x0000000000540000-memory.dmp
memory/2444-206-0x0000000002190000-0x0000000002191000-memory.dmp
memory/2444-263-0x0000000000400000-0x0000000000540000-memory.dmp
memory/2444-207-0x0000000000400000-0x0000000000540000-memory.dmp
memory/3408-197-0x00000000064F0000-0x0000000006502000-memory.dmp
memory/4260-129-0x0000000000400000-0x0000000000540000-memory.dmp
memory/4260-0-0x00000000022C0000-0x00000000022C1000-memory.dmp
memory/4564-183-0x0000000006160000-0x0000000006704000-memory.dmp
memory/4564-208-0x0000000005B10000-0x0000000005B20000-memory.dmp
memory/4564-205-0x000000007284E000-0x000000007284F000-memory.dmp
memory/4564-201-0x0000000009C50000-0x0000000009C8C000-memory.dmp
memory/4564-199-0x0000000009C20000-0x0000000009C42000-memory.dmp
memory/4564-198-0x0000000006B90000-0x0000000006B9A000-memory.dmp
memory/4564-196-0x0000000006C30000-0x0000000006CC2000-memory.dmp
memory/4564-185-0x0000000005B10000-0x0000000005B20000-memory.dmp
memory/4564-184-0x0000000005A40000-0x0000000005AA6000-memory.dmp
memory/4564-132-0x00000000033D0000-0x0000000003412000-memory.dmp
memory/4564-131-0x0000000000FB0000-0x000000000103A000-memory.dmp
memory/4564-118-0x000000007284E000-0x000000007284F000-memory.dmp