xred | 4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/02/2025, 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe
Size

1.4MB
MD5

0eaeabee75f9f0587f6b281f0dba1a40
SHA1

032b248b6466c4b1716c2bbc0fca2d54e151a678
SHA256

4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3
SHA512

77160e900e8f758f5c97081976d4679d06346d8646be316e4a77bce4fad016a38ee6be3b77269fbef85880bd3e7da2d603cc9868fb4c3194e022f723f5c3f848
SSDEEP

24576:cnsJ39LyjbJkQFMhmC+6GD9y4ptpPFR668rjHSzDTYEcyU76BuTD:cnsHyjtk2MYC5GDxpdR6JiS76BGD

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 3 IoCs

pid	Process
2580	._cache_4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe
2324	Synaptics.exe
2808	._cache_Synaptics.exe

Loads dropped DLL 7 IoCs

pid	Process
2940	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe
2940	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe
2940	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe
2940	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe
2324	Synaptics.exe
2324	Synaptics.exe
2324	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2808	._cache_Synaptics.exe
2580	._cache_4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe
2580	._cache_4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
108	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2580	._cache_4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe
2808	._cache_Synaptics.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2580	._cache_4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe
2808	._cache_Synaptics.exe
108	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2580	2940	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe	30
PID 2940 wrote to memory of 2580	2940	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe	30
PID 2940 wrote to memory of 2580	2940	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe	30
PID 2940 wrote to memory of 2580	2940	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe	30
PID 2940 wrote to memory of 2324	2940	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe	31
PID 2940 wrote to memory of 2324	2940	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe	31
PID 2940 wrote to memory of 2324	2940	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe	31
PID 2940 wrote to memory of 2324	2940	4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe	31
PID 2324 wrote to memory of 2808	2324	Synaptics.exe	32
PID 2324 wrote to memory of 2808	2324	Synaptics.exe	32
PID 2324 wrote to memory of 2808	2324	Synaptics.exe	32
PID 2324 wrote to memory of 2808	2324	Synaptics.exe	32

C:\Users\Admin\AppData\Local\Temp\4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe
"C:\Users\Admin\AppData\Local\Temp\4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\._cache_4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2580
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2808

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.4MB

MD5
0eaeabee75f9f0587f6b281f0dba1a40

SHA1
032b248b6466c4b1716c2bbc0fca2d54e151a678

SHA256
4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3

SHA512
77160e900e8f758f5c97081976d4679d06346d8646be316e4a77bce4fad016a38ee6be3b77269fbef85880bd3e7da2d603cc9868fb4c3194e022f723f5c3f848

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_4beed24364c7765d9af9ce4850f24c3dbb6e92bb55797eedbd27fefbb24de1a3N.exe

Filesize
668KB

MD5
1977dce33ddd2d30c922ae2b7f4e3c92

SHA1
3eadc55ef9fa44ed5eb6d039c3e0732d38f2777f

SHA256
885657592072f46dca2c6172b8f23c9c6f97d0ee0615b0f1cba8e4aee3cbf244

SHA512
b9dfc57552a63e8f36c105368472e1d26fbafcc52f2246591bd6e8a0ddc14a4a2763824f82e72ccf53232994c1e8051ca24fac9c7840da0270a4df8ddce07017

Download Submit
C:\Users\Admin\AppData\Local\Temp\gIrdoyPW.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\gIrdoyPW.xlsm

Filesize
21KB

MD5
8d5f6a5cd894f189167d100e60cd18a6

SHA1
b606af88b707057af9d35066499772a97fc4760e

SHA256
a9969a65424af8b77fe2e638a9fdb38dbfec55123bea6620b6a6374028e10986

SHA512
1ae03b81af19886f9681ce603b51380a5b6deb8d4082877224f61f18002e59999b14ce7df762f90082a60f22bd9c362dcb388ecc8d4511cf7440d56ec94dc51a

Download Submit
C:\Users\Admin\AppData\Local\Temp\gIrdoyPW.xlsm

Filesize
25KB

MD5
affd7cb366839bcc0f274d40ebdb62ce

SHA1
66eee701c4e57921ad2921bba8398858ed30e176

SHA256
49c3f396c018d02110c776e268c09bf1c6787c4a6b937a524047a64203ff98e9

SHA512
2447486e655f83069a38428e41788f6582c4bba32afb1c5f4eaa64976aa7b76b3a2e1189a482a33996b598e61d46b1c3af17955ebaacfcaf1abf09791ad5d839

Download Submit
C:\Users\Admin\AppData\Local\Temp\gIrdoyPW.xlsm

Filesize
23KB

MD5
90a5a5c553814e2705fb81c9b38bea81

SHA1
10149e087009d2097203149882139fd6255cb59b

SHA256
5de39e0cb68d2345f70af9f1dc5136e7b0ee128e0e27e4d5a4d106fc79befcc5

SHA512
6723ab35492d246f603dd4605879c9ea7b2b5efadbf199a9d8a8f6669cc2f602b937d4ee5125f105c27327bf45c8d3f542320b01588b09887fb1471e443f7b14

Download Submit
C:\Users\Admin\AppData\Local\Temp\gIrdoyPW.xlsm

Filesize
21KB

MD5
fa95142cdda4116e96f8b91ee56ccacf

SHA1
1362d824cf109bc862e995cc803d4df4c297a1f1

SHA256
ba38ca501aac5497f27aae0650fa874bcc4de8aa20326391e6a9956962cd600d

SHA512
9a3e2ada132c9619e6561adaa5ea9bff3a2439e11349e6049e308001ec003c93f44a36b9497f49a81bf38abf19719b5c238e8c3033616140f1841841ea1f23ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\gIrdoyPW.xlsm

Filesize
26KB

MD5
be041c7bb999b7da6953864a57d8e63c

SHA1
a3301781497a54b1645cc6733a05977b5d54866b

SHA256
266d2e05d2a609b8550e6a6ea89679e8dd6aa057dcb10c2aeb2e831d7c9ba95c

SHA512
06496c23c66e7076a667b3fab52e09ed25b32e43f9c735bc0a3cd05d100f2ca6a077f804330eb10a47654dc5993a669e5618d1de2d91c9f27d5416807fa3ccd7

Download Submit
C:\Users\Admin\Desktop\~$OpenBackup.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
memory/108-51-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/108-138-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2324-43-0x00000000056F0000-0x0000000005B3E000-memory.dmp

Filesize
4.3MB

Download
memory/2324-49-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/2324-47-0x00000000056F0000-0x0000000005B3E000-memory.dmp

Filesize
4.3MB

Download
memory/2324-172-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/2324-140-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/2324-139-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/2580-21-0x0000000000400000-0x000000000084E000-memory.dmp

Filesize
4.3MB

Download
memory/2580-50-0x0000000000400000-0x000000000084E000-memory.dmp

Filesize
4.3MB

Download
memory/2580-46-0x0000000000400000-0x000000000084E000-memory.dmp

Filesize
4.3MB

Download
memory/2580-48-0x0000000000400000-0x000000000084E000-memory.dmp

Filesize
4.3MB

Download
memory/2808-44-0x0000000000400000-0x000000000084E000-memory.dmp

Filesize
4.3MB

Download
memory/2808-45-0x0000000000400000-0x000000000084E000-memory.dmp

Filesize
4.3MB

Download
memory/2940-19-0x00000000058A0000-0x0000000005CEE000-memory.dmp

Filesize
4.3MB

Download
memory/2940-29-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/2940-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download