xred | f7cd91ffd91485b364ffc57340a29e12ad5a594d6b4fa1670a221aaf5df3c583

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/02/2025, 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EMPTERROR_dropperV2.exe
Size

6.1MB
MD5

f5e8e61944dda89d469dd493af83ef46
SHA1

b7f1f7ccd1d8ee39b232aa24f3653dca504679e9
SHA256

f7cd91ffd91485b364ffc57340a29e12ad5a594d6b4fa1670a221aaf5df3c583
SHA512

7546fcc2810639d8ed74c019e75278e6cb485840c27980e80b0a42d7c00bac283beb0cb7fa3040dc0d4c0ae4204b8e5dd1938b44d19b7d307cb94fe00e6a5712
SSDEEP

98304:4nsmtk2alVEh+bGJDBsPDyV5pDOYBK+tC4/ve2jT4JrTi7aL9vr:GLN8+V5paY8iRvx8viW

Score

10^/10

xred backdoor discovery persistence vmprotect

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
1812	._cache_EMPTERROR_dropperV2.exe
2804	Synaptics.exe
2612	._cache_Synaptics.exe

Loads dropped DLL 7 IoCs

pid	Process
1816	EMPTERROR_dropperV2.exe
1816	EMPTERROR_dropperV2.exe
1816	EMPTERROR_dropperV2.exe
1816	EMPTERROR_dropperV2.exe
2804	Synaptics.exe
2804	Synaptics.exe
2804	Synaptics.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000c000000012277-4.dat	vmprotect
behavioral1/memory/1812-72-0x0000000000400000-0x0000000000CA9000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	EMPTERROR_dropperV2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1812	._cache_EMPTERROR_dropperV2.exe
2612	._cache_Synaptics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_EMPTERROR_dropperV2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMPTERROR_dropperV2.exe

Delays execution with timeout.exe 4 IoCs

defense_evasion

pid	Process
2328	timeout.exe
1612	timeout.exe
1632	timeout.exe
2384	timeout.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2056	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1812	._cache_EMPTERROR_dropperV2.exe
1812	._cache_EMPTERROR_dropperV2.exe
2612	._cache_Synaptics.exe
2612	._cache_Synaptics.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2056	EXCEL.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1812	1816	EMPTERROR_dropperV2.exe	30
PID 1816 wrote to memory of 1812	1816	EMPTERROR_dropperV2.exe	30
PID 1816 wrote to memory of 1812	1816	EMPTERROR_dropperV2.exe	30
PID 1816 wrote to memory of 1812	1816	EMPTERROR_dropperV2.exe	30
PID 1816 wrote to memory of 2804	1816	EMPTERROR_dropperV2.exe	32
PID 1816 wrote to memory of 2804	1816	EMPTERROR_dropperV2.exe	32
PID 1816 wrote to memory of 2804	1816	EMPTERROR_dropperV2.exe	32
PID 1816 wrote to memory of 2804	1816	EMPTERROR_dropperV2.exe	32
PID 1812 wrote to memory of 1076	1812	._cache_EMPTERROR_dropperV2.exe	33
PID 1812 wrote to memory of 1076	1812	._cache_EMPTERROR_dropperV2.exe	33
PID 1812 wrote to memory of 1076	1812	._cache_EMPTERROR_dropperV2.exe	33
PID 1812 wrote to memory of 1076	1812	._cache_EMPTERROR_dropperV2.exe	33
PID 2804 wrote to memory of 2612	2804	Synaptics.exe	34
PID 2804 wrote to memory of 2612	2804	Synaptics.exe	34
PID 2804 wrote to memory of 2612	2804	Synaptics.exe	34
PID 2804 wrote to memory of 2612	2804	Synaptics.exe	34
PID 1076 wrote to memory of 2328	1076	cmd.exe	36
PID 1076 wrote to memory of 2328	1076	cmd.exe	36
PID 1076 wrote to memory of 2328	1076	cmd.exe	36
PID 2612 wrote to memory of 1404	2612	._cache_Synaptics.exe	37
PID 2612 wrote to memory of 1404	2612	._cache_Synaptics.exe	37
PID 2612 wrote to memory of 1404	2612	._cache_Synaptics.exe	37
PID 2612 wrote to memory of 1404	2612	._cache_Synaptics.exe	37
PID 1404 wrote to memory of 1612	1404	cmd.exe	38
PID 1404 wrote to memory of 1612	1404	cmd.exe	38
PID 1404 wrote to memory of 1612	1404	cmd.exe	38
PID 1076 wrote to memory of 1632	1076	cmd.exe	40
PID 1076 wrote to memory of 1632	1076	cmd.exe	40
PID 1076 wrote to memory of 1632	1076	cmd.exe	40
PID 1404 wrote to memory of 2384	1404	cmd.exe	41
PID 1404 wrote to memory of 2384	1404	cmd.exe	41
PID 1404 wrote to memory of 2384	1404	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\EMPTERROR_dropperV2.exe
"C:\Users\Admin\AppData\Local\Temp\EMPTERROR_dropperV2.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\._cache_EMPTERROR_dropperV2.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_EMPTERROR_dropperV2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BCBA.tmp\BCBB.tmp\BCBC.bat C:\Users\Admin\AppData\Local\Temp\._cache_EMPTERROR_dropperV2.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2328
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1632
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BFA7.tmp\BFA8.tmp\BFA9.bat C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe InjUpdate"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1404
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:1612
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:2384

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
6.1MB

MD5
f5e8e61944dda89d469dd493af83ef46

SHA1
b7f1f7ccd1d8ee39b232aa24f3653dca504679e9

SHA256
f7cd91ffd91485b364ffc57340a29e12ad5a594d6b4fa1670a221aaf5df3c583

SHA512
7546fcc2810639d8ed74c019e75278e6cb485840c27980e80b0a42d7c00bac283beb0cb7fa3040dc0d4c0ae4204b8e5dd1938b44d19b7d307cb94fe00e6a5712

Download Submit
C:\Users\Admin\AppData\Local\Temp\BCBA.tmp\BCBB.tmp\BCBC.bat

Filesize
3KB

MD5
74d512b655ec5c584a843ff91c51acd6

SHA1
170c81bd3beb39e3b0c917b1b5a5c0d08e3967ed

SHA256
b824d4dffcc9d5397848f5b03b98028600f75556ace655406f5c068eca0c8ece

SHA512
739a192932c433265c01136baed26db6b40cd7963e8438c2af80768ed79926b384a426b6c097f4ea3ad4af9980696414ada86ff883733d7994340323e68b580e

Download Submit
C:\Users\Admin\AppData\Local\Temp\aGZmOemk.xlsm

Filesize
24KB

MD5
7d106cc7a0f48bc003ec395b94e89cbb

SHA1
19fe1dc4258d4a425e342b3d970360403e9c8c85

SHA256
993511b341e5428197e7c5f0b3a5a3e33e35a5757e7e17f77c649533c6b82cec

SHA512
fb88cbe361290f89f100f8eeb6b1dc52ac226b2f8170972387653651b09f34d2ac5a394b1413447d65fbda426086beb0c921631112f817e981ee6eea1e16dc78

Download Submit
C:\Users\Admin\AppData\Local\Temp\aGZmOemk.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_EMPTERROR_dropperV2.exe

Filesize
5.4MB

MD5
bafd26031bdba012128d90b6a81a3c99

SHA1
f23d3c73706674f8585b9246d600141076f646b0

SHA256
7e49f4fa320883805c2aae7ea4fc36c658f21f9cfb23459feee0429e0e5fa5dd

SHA512
72d6335df5c0a94b1ff9991318d7fe6afc2f5f5dbac23ccf51ae0c3e5de454d6ec25c97e447ed0db1a44e32fb924f2a60de69b2053d2e7636c83205fdce428d1

Download Submit
memory/1812-46-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1812-41-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1812-69-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1812-67-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1812-66-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1812-64-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1812-62-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1812-56-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1812-54-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1812-51-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1812-49-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1812-61-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1812-44-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1812-71-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1812-39-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1812-37-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1812-72-0x0000000000400000-0x0000000000CA9000-memory.dmp

Filesize
8.7MB

Download
memory/1812-36-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1812-34-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1812-32-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1812-59-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1816-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1816-28-0x0000000000400000-0x0000000000A25000-memory.dmp

Filesize
6.1MB

Download
memory/2612-106-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2612-104-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2612-101-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2612-99-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download