Analysis
-
max time kernel
32s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
22/03/2025, 06:10
General
-
Target
45031250d699e08b14558e0a13a75d94.exe
-
Size
16.1MB
-
MD5
45031250d699e08b14558e0a13a75d94
-
SHA1
f52f77522198079fef50d275d7b465b08741245f
-
SHA256
da9de4402f6983b7c93b6f30084b115e98f1c7603828922ff37cf6af9cccb9f9
-
SHA512
0b8e97999ffaf0b676b81dd0aeda0ec9a48f8dc982f7f3e380c91711ed30615e1d7502dfc9f8cef95efde5e979ef57feb76ae232f0ffe3419d8e2a0f133ea946
-
SSDEEP
393216:PGg4aXGg4amGg4aiGg4aiGg4aCGg4aOGg4aCGg4a6Gg4aKGg4aGGg4ayGg4a74:PH0QQwMwYoUg74
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Suspicious Office macro 1 IoCs
Office document equipped with macros.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\45031250d699e08b14558e0a13a75d94.exe"C:\Users\Admin\AppData\Local\Temp\45031250d699e08b14558e0a13a75d94.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\45031250d699e08b14558e0a13a75d94.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sXLAWJKdeDZVj.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sXLAWJKdeDZVj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB74A.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\45031250d699e08b14558e0a13a75d94.exe"C:\Users\Admin\AppData\Local\Temp\45031250d699e08b14558e0a13a75d94.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_45031250d699e08b14558e0a13a75d94.exe"C:\Users\Admin\AppData\Local\Temp\._cache_45031250d699e08b14558e0a13a75d94.exe"3⤵
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sXLAWJKdeDZVj.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sXLAWJKdeDZVj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3803.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"5⤵
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.9MB
MD5bbb36652c20799a8c90aecac15e52ad9
SHA1a397d1c26d10b215091ed58011d7cfd7ba718c6a
SHA2560195c6fa3d2e56ccbe83c1f89e7247a46a40c9de6a95c7b3e760009e352ff0c5
SHA51225880928324be7f8adf2799dbfd706ff2e9520ec0f65a6b6964086aa098272291fba88ccbd8fab35c9fe072e1e14a53add583c87805c8c58372f8b6b10b9b073
-
Filesize
14.1MB
MD500317a57f6a745c97dba72dd02432017
SHA17f4fd482e1c777586142920b6ca557eee2e1559f
SHA2565bc8d750d44c2640bdb5bcb865ee07bffa0287bf6167805c48a48d229b739673
SHA5129e72939e2a13e225422e9cdd4439e59f4de877f308c126b2ac71a4c6098407f91d58749eb99512d1c0294a3023fcb677430597b4fac6c3d101b7852f2e052830
-
Filesize
14.8MB
MD596ee84419c75d848a860b0e2cfd8c8e1
SHA136e8b4c0e4b52d9fb793e4061517434956a04413
SHA256a06fec2bee28c43d6b17894093904ece6a763fad11a47f861faf6f4296eb5f71
SHA512f08b3a87a5d109b4be8d828ca457551d46d983bad361505b7a63077161aac11809af0647a8c7c5ba769e8628f1d6e88825f3a5511b164091956019221a91e294
-
Filesize
10.6MB
MD523719150abdfe1e75ea5fa937720ce14
SHA190fdeff5acf830d4dee8994cc68561b073f39db2
SHA256276cc50bdb3fb024d291a59c389cca0daf04fb3e882871d24961628227587d11
SHA512145a6827574ca7cd710b96de679cfdd8113167a94d16ee266327173c3592945aa414ddd0f24a9a6acc126f9823c08562fad409339c4c9100d67236814c47567d
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD52f3fbf4fdffbdf66c8c14c6eec76154a
SHA19198519013152883cee750cf029a3da63d1773d9
SHA2566d3f6736930971f167b542ec3ddaa760ce65ce27cab96af39c0e349963499a10
SHA512ff31bb429d0e2f88a8e283c9b84101fe56f6d1912dd4eb2300bca22b1d2047f603637a23afe0fe9b988ef9ab1324a01bf5a28e6b0c7c64eb1d5d017808230642
-
Filesize
18KB
MD5c4d5e9cfacacd73881de74e6b190a113
SHA110122d97f1fbee1297c35113e5dab611d5d613ed
SHA256773a916bd6e751de7d29b74a6f2defb61e415fd43a8f2649080a14117213b673
SHA51290aa853130d20a775d663923c7291118ab718f650343769bbdd6de0eb89c647ba2990e48625663c5838127e912e2d57272dd1fe6db1d671366168e637816ab26
-
Filesize
91KB
MD5b45e3c4c10da3da0c69e2f90dc3dfb10
SHA161a36473ced38978793a9af1aea1fc528eebe457
SHA256b6fe518ed8ca7ee32f79bb5dd52ab8250cc595d1aa8daec123cef383c6b0bdb6
SHA51244d0c2e0904702dd22c92004415ef3c821bf63de0fb0cc6d7cca41eab36f32531530dd5fdb48017fc5405c7554ae6387514ef3f4e74eea4b36a14d587742e15b
-
Filesize
22KB
MD5ea7635b6f43a7803d757b87bf57b199e
SHA1384fb749f78233f771268945ebf19f533d271830
SHA25666b26325f95a0031510779d1eccda683b5a10b9b37bd262d4b59082613a9d5cb
SHA5129f198bc5fbb7c1528c5d452cd6589162776875d71d4ff128d67c35ce557534d99af724d00c22a0d67860a83edad97c3ee203b824451113a4e31383b1beaefda4
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5d718df15beb657a8928574cd882ed882
SHA18517b893b4cb85b9217acb9751fbfb1902a938ab
SHA2569236a80685b9d50ed288adda0ff8750093f90fa7a62374902a0bd89b05944d59
SHA5127eaab7dad13e69110d4660a27ff7802ed49a51222d2142bcb0ef69b57bf4dce7f2ae1daec98a537814646f1f8b32138d17074f829feed95c5a65b55cbe7c162c
-
Filesize
120KB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
1.4MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
16.1MB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
200KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
6.5MB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
652KB
-
Filesize
408KB
-
Filesize
304KB
-
Filesize
216KB
-
Filesize
652KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
304KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
304KB
-
Filesize
80KB
-
Filesize
68KB
-
Filesize
3.3MB