Analysis

  • max time kernel
    135s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:14

General

  • Target

    95fc2287fc4fea75666b56cfd668d72c.exe

  • Size

    9.7MB

  • MD5

    95fc2287fc4fea75666b56cfd668d72c

  • SHA1

    9de58712ca97a8b052b21f8ce7afa9708b671c2b

  • SHA256

    16e39062569dd0ef3936b52c974370c6ef11b58149eae4f9d42b7f1079765091

  • SHA512

    96371451474490e42cf2444eee70a1a1be4f0a32888f348e1d3ea004bc71621dce799b1190fd9388d2bde36a5d3c57ad9d79c602a798dad5ec626a161032bf70

  • SSDEEP

    196608:2Nsg4AMgAINsg4AMgAFNsg4AMgAINsg4AMgAENsg4AMgAiNsg4AMgAANsg4AMgAu:2Gg4a3Gg4aqGg4ajGg4aDGg4a1Gg4aP9

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe
    "C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4336
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sXLAWJKdeDZVj.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2364
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sXLAWJKdeDZVj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD84F.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4280
    • C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe
      "C:\Users\Admin\AppData\Local\Temp\95fc2287fc4fea75666b56cfd668d72c.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Users\Admin\AppData\Local\Temp\._cache_95fc2287fc4fea75666b56cfd668d72c.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_95fc2287fc4fea75666b56cfd668d72c.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5708
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3452
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6092
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sXLAWJKdeDZVj.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5804
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sXLAWJKdeDZVj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp59A4.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2200
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4500
          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
            5⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook profiles
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:3200
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:5212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    9.7MB

    MD5

    95fc2287fc4fea75666b56cfd668d72c

    SHA1

    9de58712ca97a8b052b21f8ce7afa9708b671c2b

    SHA256

    16e39062569dd0ef3936b52c974370c6ef11b58149eae4f9d42b7f1079765091

    SHA512

    96371451474490e42cf2444eee70a1a1be4f0a32888f348e1d3ea004bc71621dce799b1190fd9388d2bde36a5d3c57ad9d79c602a798dad5ec626a161032bf70

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    3d086a433708053f9bf9523e1d87a4e8

    SHA1

    b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

    SHA256

    6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

    SHA512

    931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    fbb533e5215874eb566970b975a0613b

    SHA1

    a45dd34ca6725ee0e3d83a3f9ba3cbb984c32d75

    SHA256

    e9c69b4027d0896e07e584a1c0cbfa26e55790c459609e2329ff95cd8c7764b3

    SHA512

    6a75d18a6fa47ec08d92d297c90e35752c182af4f76dfd4bc78bb2665605cda18d112549cab8119a16f3fa12e26cacbc9ec19523b269a0641a5e0b7d77ca4297

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    e0b2f9bf8c069da3ad1a75fa99e6dd3d

    SHA1

    f7e01ddd2f2d9b70b5d4dcd983e5de51f0122db1

    SHA256

    064ab815dc908924a8476d325487f46201d2825c489db9444bdc9780789c1bcb

    SHA512

    44f02c07e68bb1ee2327d7c9cc054a125df6b24567ec2929ce6ff44628bbf55da09a4ee2d606874fedf0dd5afde6ce038bbf8bfcd23e55efe86b673555355c6c

  • C:\Users\Admin\AppData\Local\Temp\._cache_95fc2287fc4fea75666b56cfd668d72c.exe

    Filesize

    91KB

    MD5

    b45e3c4c10da3da0c69e2f90dc3dfb10

    SHA1

    61a36473ced38978793a9af1aea1fc528eebe457

    SHA256

    b6fe518ed8ca7ee32f79bb5dd52ab8250cc595d1aa8daec123cef383c6b0bdb6

    SHA512

    44d0c2e0904702dd22c92004415ef3c821bf63de0fb0cc6d7cca41eab36f32531530dd5fdb48017fc5405c7554ae6387514ef3f4e74eea4b36a14d587742e15b

  • C:\Users\Admin\AppData\Local\Temp\Lte6hX87.xlsm

    Filesize

    23KB

    MD5

    242927cd20c90961672475247f971560

    SHA1

    af95d6684f1d389319ca2ebbc88ab4dfb7c27bdb

    SHA256

    707dbe8e7475d9922ec237609633b1f0659f8b539d9c18e82ce4064b1c49b813

    SHA512

    f88cb9e66a2f867a78219b147bcf523476b06a2817bc36655091db13a2683fa927d2f8d20a5344bc7f1bb65162420728f15ec1cf1462b9f8d43975627129d583

  • C:\Users\Admin\AppData\Local\Temp\Lte6hX87.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_poom2xoj.cn2.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmpD84F.tmp

    Filesize

    1KB

    MD5

    77eae26d27c39f4aa256905fcaab2f7b

    SHA1

    07ea96f702fc193cbf8a26b54666ba4a6b511610

    SHA256

    401a9948039416657ac3dadca4406930e421c98c2b7f97bdfb68e944201eddd0

    SHA512

    b17fbc2f8a272723d241d9b9f72013d61bdc9051c53ee3f12c99b82d3d30bf38de9a815bbb33fda9cbdae9b25c887f857a163d63d447981ec9cf8577e09ce321

  • memory/2352-47-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2352-48-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2364-33-0x00000000751B0000-0x0000000075960000-memory.dmp

    Filesize

    7.7MB

  • memory/2364-205-0x0000000007820000-0x000000000783A000-memory.dmp

    Filesize

    104KB

  • memory/2364-122-0x00000000074A0000-0x00000000074D2000-memory.dmp

    Filesize

    200KB

  • memory/2364-145-0x0000000007480000-0x000000000749E000-memory.dmp

    Filesize

    120KB

  • memory/2364-206-0x0000000007890000-0x000000000789A000-memory.dmp

    Filesize

    40KB

  • memory/2364-193-0x00000000076F0000-0x0000000007793000-memory.dmp

    Filesize

    652KB

  • memory/2364-22-0x00000000751B0000-0x0000000075960000-memory.dmp

    Filesize

    7.7MB

  • memory/2364-212-0x0000000007B40000-0x0000000007B48000-memory.dmp

    Filesize

    32KB

  • memory/2364-37-0x00000000751B0000-0x0000000075960000-memory.dmp

    Filesize

    7.7MB

  • memory/2364-219-0x00000000751B0000-0x0000000075960000-memory.dmp

    Filesize

    7.7MB

  • memory/2364-123-0x00000000711C0000-0x000000007120C000-memory.dmp

    Filesize

    304KB

  • memory/2364-207-0x0000000007AA0000-0x0000000007B36000-memory.dmp

    Filesize

    600KB

  • memory/3032-9-0x00000000751BE000-0x00000000751BF000-memory.dmp

    Filesize

    4KB

  • memory/3032-0-0x00000000751BE000-0x00000000751BF000-memory.dmp

    Filesize

    4KB

  • memory/3032-50-0x00000000751B0000-0x0000000075960000-memory.dmp

    Filesize

    7.7MB

  • memory/3032-12-0x000000000D420000-0x000000000D4BC000-memory.dmp

    Filesize

    624KB

  • memory/3032-11-0x0000000008CB0000-0x0000000008DCE000-memory.dmp

    Filesize

    1.1MB

  • memory/3032-10-0x00000000751B0000-0x0000000075960000-memory.dmp

    Filesize

    7.7MB

  • memory/3032-8-0x0000000007070000-0x000000000708E000-memory.dmp

    Filesize

    120KB

  • memory/3032-7-0x0000000006F10000-0x000000000706C000-memory.dmp

    Filesize

    1.4MB

  • memory/3032-5-0x0000000005CE0000-0x0000000005CEA000-memory.dmp

    Filesize

    40KB

  • memory/3032-6-0x00000000751B0000-0x0000000075960000-memory.dmp

    Filesize

    7.7MB

  • memory/3032-3-0x0000000005890000-0x0000000005922000-memory.dmp

    Filesize

    584KB

  • memory/3032-4-0x0000000005930000-0x0000000005C84000-memory.dmp

    Filesize

    3.3MB

  • memory/3032-2-0x0000000005DA0000-0x0000000006344000-memory.dmp

    Filesize

    5.6MB

  • memory/3032-1-0x00000000004E0000-0x0000000000E94000-memory.dmp

    Filesize

    9.7MB

  • memory/4336-30-0x00000000056E0000-0x0000000005746000-memory.dmp

    Filesize

    408KB

  • memory/4336-20-0x00000000751B0000-0x0000000075960000-memory.dmp

    Filesize

    7.7MB

  • memory/4336-204-0x0000000007830000-0x0000000007EAA000-memory.dmp

    Filesize

    6.5MB

  • memory/4336-17-0x0000000004920000-0x0000000004956000-memory.dmp

    Filesize

    216KB

  • memory/4336-102-0x0000000006190000-0x00000000061DC000-memory.dmp

    Filesize

    304KB

  • memory/4336-95-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

    Filesize

    120KB

  • memory/4336-208-0x00000000073E0000-0x00000000073F1000-memory.dmp

    Filesize

    68KB

  • memory/4336-209-0x0000000007410000-0x000000000741E000-memory.dmp

    Filesize

    56KB

  • memory/4336-210-0x0000000007420000-0x0000000007434000-memory.dmp

    Filesize

    80KB

  • memory/4336-21-0x00000000751B0000-0x0000000075960000-memory.dmp

    Filesize

    7.7MB

  • memory/4336-211-0x0000000007520000-0x000000000753A000-memory.dmp

    Filesize

    104KB

  • memory/4336-28-0x0000000005000000-0x0000000005022000-memory.dmp

    Filesize

    136KB

  • memory/4336-218-0x00000000751B0000-0x0000000075960000-memory.dmp

    Filesize

    7.7MB

  • memory/4336-31-0x0000000005840000-0x00000000058A6000-memory.dmp

    Filesize

    408KB

  • memory/4336-18-0x00000000751B0000-0x0000000075960000-memory.dmp

    Filesize

    7.7MB

  • memory/4336-19-0x0000000005040000-0x0000000005668000-memory.dmp

    Filesize

    6.2MB

  • memory/4336-133-0x00000000711C0000-0x000000007120C000-memory.dmp

    Filesize

    304KB

  • memory/4500-244-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/4500-418-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/4500-401-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/4500-382-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/4500-383-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/5212-329-0x00007FFAC5C10000-0x00007FFAC5C20000-memory.dmp

    Filesize

    64KB

  • memory/5212-400-0x00007FFAC5C10000-0x00007FFAC5C20000-memory.dmp

    Filesize

    64KB

  • memory/5212-333-0x00007FFAC5C10000-0x00007FFAC5C20000-memory.dmp

    Filesize

    64KB

  • memory/5212-335-0x00007FFAC3850000-0x00007FFAC3860000-memory.dmp

    Filesize

    64KB

  • memory/5212-331-0x00007FFAC5C10000-0x00007FFAC5C20000-memory.dmp

    Filesize

    64KB

  • memory/5212-336-0x00007FFAC3850000-0x00007FFAC3860000-memory.dmp

    Filesize

    64KB

  • memory/5212-330-0x00007FFAC5C10000-0x00007FFAC5C20000-memory.dmp

    Filesize

    64KB

  • memory/5212-332-0x00007FFAC5C10000-0x00007FFAC5C20000-memory.dmp

    Filesize

    64KB

  • memory/5212-397-0x00007FFAC5C10000-0x00007FFAC5C20000-memory.dmp

    Filesize

    64KB

  • memory/5212-398-0x00007FFAC5C10000-0x00007FFAC5C20000-memory.dmp

    Filesize

    64KB

  • memory/5212-399-0x00007FFAC5C10000-0x00007FFAC5C20000-memory.dmp

    Filesize

    64KB

  • memory/5708-221-0x00000000068C0000-0x0000000006A82000-memory.dmp

    Filesize

    1.8MB

  • memory/5708-134-0x00000000009A0000-0x00000000009BE000-memory.dmp

    Filesize

    120KB

  • memory/5708-220-0x0000000006500000-0x0000000006550000-memory.dmp

    Filesize

    320KB

  • memory/5804-309-0x00000000714D0000-0x000000007151C000-memory.dmp

    Filesize

    304KB

  • memory/6092-308-0x00000000074C0000-0x0000000007563000-memory.dmp

    Filesize

    652KB

  • memory/6092-334-0x00000000077A0000-0x00000000077B1000-memory.dmp

    Filesize

    68KB

  • memory/6092-337-0x00000000077E0000-0x00000000077F4000-memory.dmp

    Filesize

    80KB

  • memory/6092-298-0x00000000714D0000-0x000000007151C000-memory.dmp

    Filesize

    304KB

  • memory/6092-249-0x00000000067E0000-0x000000000682C000-memory.dmp

    Filesize

    304KB