Analysis

  • max time kernel
    125s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:14

General

  • Target

    95fc2287fc4fea75666b56cfd668d72c.exe

  • Size

    9.7MB

  • MD5

    95fc2287fc4fea75666b56cfd668d72c

  • SHA1

    9de58712ca97a8b052b21f8ce7afa9708b671c2b

  • SHA256

    16e39062569dd0ef3936b52c974370c6ef11b58149eae4f9d42b7f1079765091

  • SHA512

    96371451474490e42cf2444eee70a1a1be4f0a32888f348e1d3ea004bc71621dce799b1190fd9388d2bde36a5d3c57ad9d79c602a798dad5ec626a161032bf70

  • SSDEEP

    196608:2Nsg4AMgAINsg4AMgAFNsg4AMgAINsg4AMgAENsg4AMgAiNsg4AMgAANsg4AMgAu:2Gg4a3Gg4aqGg4ajGg4aDGg4a1Gg4aP9

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious Office macro 2 IoCs

    Office document equipped with macros.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe
    "C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1940
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sXLAWJKdeDZVj.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:576
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sXLAWJKdeDZVj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE975.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:1012
    • C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe
      "C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2360
      • C:\Users\Admin\AppData\Local\Temp\._cache_95fc2287fc4fea75666b56cfd668d72c.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_95fc2287fc4fea75666b56cfd668d72c.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2972
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2992
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1976
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sXLAWJKdeDZVj.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1416
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sXLAWJKdeDZVj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp621D.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:780
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1700
          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
            5⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook profiles
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:2424
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    9.7MB

    MD5

    95fc2287fc4fea75666b56cfd668d72c

    SHA1

    9de58712ca97a8b052b21f8ce7afa9708b671c2b

    SHA256

    16e39062569dd0ef3936b52c974370c6ef11b58149eae4f9d42b7f1079765091

    SHA512

    96371451474490e42cf2444eee70a1a1be4f0a32888f348e1d3ea004bc71621dce799b1190fd9388d2bde36a5d3c57ad9d79c602a798dad5ec626a161032bf70

  • C:\Users\Admin\AppData\Local\Temp\._cache_95fc2287fc4fea75666b56cfd668d72c.exe

    Filesize

    91KB

    MD5

    b45e3c4c10da3da0c69e2f90dc3dfb10

    SHA1

    61a36473ced38978793a9af1aea1fc528eebe457

    SHA256

    b6fe518ed8ca7ee32f79bb5dd52ab8250cc595d1aa8daec123cef383c6b0bdb6

    SHA512

    44d0c2e0904702dd22c92004415ef3c821bf63de0fb0cc6d7cca41eab36f32531530dd5fdb48017fc5405c7554ae6387514ef3f4e74eea4b36a14d587742e15b

  • C:\Users\Admin\AppData\Local\Temp\VvhbSuaC.xlsm

    Filesize

    20KB

    MD5

    41d5934cb33a5be7f2178c2f3b5b465a

    SHA1

    2f1ea19a8e2cc27df1c19a92abac68a1eec50ed2

    SHA256

    62e7f494c8cb083fec242164d8e2394ebedacad0d09394676d62e04b17e0d2ed

    SHA512

    c56e832d53152ef68952718c721f80eb136d34c95d4578a406c47fbc4cc306eb33d6b048dbe555ecbea9344eadb9875becc70d3cbe4db509ce0d738d82502a99

  • C:\Users\Admin\AppData\Local\Temp\VvhbSuaC.xlsm

    Filesize

    22KB

    MD5

    81c6f87ee16af0e9e27099bfb8fb5251

    SHA1

    0529e965d84d52e9086f91f2da84ade8cfa0ee03

    SHA256

    31d0a0041ff4fff02ae09df6e49be470a1136e106ef7b125b2e552f2c1f4aa48

    SHA512

    8d46f2bf0887623b876e9618d869468bddb0f1d1f9e1a767245369960c0f2d30d29c5743c91c66c6fcae336831332f80529369d5d68e51eefc579735d89d3f60

  • C:\Users\Admin\AppData\Local\Temp\VvhbSuaC.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\tmpE975.tmp

    Filesize

    1KB

    MD5

    9d72bca34262a2e7fba3de3a03c2e049

    SHA1

    185c80e95fb884d857f3659b480c8c2d082c28a5

    SHA256

    781e99a7459eae1031bf16603bf5ac31b442bdfbcec28521208e9629e3786306

    SHA512

    5bce4ec0b0f2e801b69b88e7b1f03db25437ba36c753f7a5f511ea50b4cbac01c57d0208ad7f60d8741949ff5132ff933cc7ea14b848cf5cc56864c1a2e5ebe7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9RCKI473SXXI885VBDEZ.temp

    Filesize

    7KB

    MD5

    fc99145e5c09b033904822638b68c427

    SHA1

    b5fbdd1243e1fe80c2a750970f85065c88eecf6f

    SHA256

    3e3af8293b04045078f89b57ddb5b95c98e1023843f09dc8ce68e114fe672e7f

    SHA512

    555bafbc1365b69094299f866af2223318d600202fbd0f032564934c96c152605ecd31dc8ceb296205db2026e1b866960b5ac56bdd6363f8ff831a3a5a1840e3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CDY599YBRLGXNPN7HKW3.temp

    Filesize

    7KB

    MD5

    d101272db906d80f3b4616620e418571

    SHA1

    113d12276958b74138534b50391c22a2acae376a

    SHA256

    0b04bfed3d96c4dd98c25fa85bc1ef306bd64b2a7578ae438e5835d4e9200331

    SHA512

    aa7752a599bd1437687ea21afeca0d68daaadd4ad5dc2198954e8c05f330b5c52e4366717c135ac9a4e08f16544ede35c010d3b7c81f6f78447a20650fe40c86

  • memory/1700-159-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1700-158-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1700-90-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1700-93-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1700-160-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1700-190-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2036-104-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2360-24-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2360-32-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2360-20-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2360-22-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2360-28-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2360-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2360-30-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2360-35-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2360-36-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2360-26-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2424-103-0x0000000000BE0000-0x0000000000BFE000-memory.dmp

    Filesize

    120KB

  • memory/2792-39-0x00000000746B0000-0x0000000074D9E000-memory.dmp

    Filesize

    6.9MB

  • memory/2792-0-0x00000000746BE000-0x00000000746BF000-memory.dmp

    Filesize

    4KB

  • memory/2792-7-0x0000000006260000-0x000000000637E000-memory.dmp

    Filesize

    1.1MB

  • memory/2792-6-0x00000000746B0000-0x0000000074D9E000-memory.dmp

    Filesize

    6.9MB

  • memory/2792-5-0x00000000746BE000-0x00000000746BF000-memory.dmp

    Filesize

    4KB

  • memory/2792-4-0x00000000006D0000-0x00000000006EE000-memory.dmp

    Filesize

    120KB

  • memory/2792-3-0x0000000005C90000-0x0000000005DEC000-memory.dmp

    Filesize

    1.4MB

  • memory/2792-2-0x00000000746B0000-0x0000000074D9E000-memory.dmp

    Filesize

    6.9MB

  • memory/2792-1-0x0000000000DD0000-0x0000000001784000-memory.dmp

    Filesize

    9.7MB

  • memory/2972-55-0x0000000000AB0000-0x0000000000ACE000-memory.dmp

    Filesize

    120KB

  • memory/2992-62-0x0000000001010000-0x00000000019C4000-memory.dmp

    Filesize

    9.7MB