Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
21/07/2026, 16:34
General
- Target 2026-07-21_d4249a12a03c7bacde103f95014dfa16_dark-comet_darkgate_elex_gcleaner_glassworm_magniber_remcos_stop.exe
- Size 9.5MB
- Sample260721-t3lcssxye1
- SHA256 d81ce1cfa7b98f60c2d44fd28b60c5a5e91f4a10074d12865c3777732dd5bec6
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Family: Xred
Xred is backdoor written in Delphi.
- Suspicious Office macro 1 IoCs
Office document equipped with macros.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 4 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_d4249a12a03c7bacde103f95014dfa16_dark-comet_darkgate_elex_gcleaner_glassworm_magniber_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_d4249a12a03c7bacde103f95014dfa16_dark-comet_darkgate_elex_gcleaner_glassworm_magniber_remcos_stop.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-21_d4249a12a03c7bacde103f95014dfa16_dark-comet_darkgate_elex_gcleaner_glassworm_magniber_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-21_d4249a12a03c7bacde103f95014dfa16_dark-comet_darkgate_elex_gcleaner_glassworm_magniber_remcos_stop.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
360Base.dll
360Common.dll
360Conf.dll
360ExtLoader.exe
360ImageDecode.dll
360NetBase.dll
360NetUL.dll
360P2SP.dll
360Util.dll
360ZipSandbox.exe
360net.dll
360verify.dll
360zip.exe
360zip.sfx
360zipExt64.dll
360zipInst.exe
360zipPluginMgr.dll
360zipUpdate.exe
360zipc.dll
360zipver.dll
360压缩官网.url
CrashReport.dll
DumpUper.exe
DumpUper.ini
EncodeHelper.dll
IEFile.ico
KitTip.dll
LiveUpd360.dll
LiveUpdate360.exe
MiniUI.dll
PDown.dll
Safelive.dll
UNACEV2.DLL
Uninstall.ico
Uninstaller.exe
cloudcom2.dll
config.xml
MiniUI.xml
Skin.jpg
defaultskin.ui
zMiniUI.xml
zclassic.ui
skin1.jpg
skin2.jpg
skin3.jpg
skin4.jpg
skin5.jpg
template1.rtf
template2.rtf
template3.rtf
template4.rtf
template5.rtf
zconfig.xml
zMiniUI.xml
zdefaultskin.ui
heavygate.dll
libgravity.dll
livep.dat
rarnew.data
360kantu.exe
iSeeImage.dll
iSeeRAW.dll
bmp.ico
gif.ico
jpg.ico
none.ico
png.ico
psd.ico
raw.ico
tif.ico
360FeedBack.xml
360Feedback.exe
360ScreenCapture.exe
feedback.ui
zipnew.data
Synaptics.exe
._cache_2026-07-21_d4249a12a03c7bacde103f95014dfa16_dark-comet_darkgate_elex_gcleaner_glassworm_magniber_remcos_stop.exe
L5oYwwDZ.xlsm
L5oYwwDZ.xlsm
{1FA7F3AB-1E7F-4f45-A449-B174922F8C7B}.tmp
memory/360-919-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/360-938-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/360-917-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/360-857-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/2060-195-0x0000000000400000-0x00000000004C2000-memory.dmp
memory/2912-111-0x0000000000E30000-0x0000000000E31000-memory.dmp
memory/2912-858-0x0000000000E30000-0x0000000000E31000-memory.dmp
memory/3328-859-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp
memory/3328-862-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp
memory/3328-863-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp
memory/3328-864-0x00007FF8E3FC0000-0x00007FF8E3FD0000-memory.dmp
memory/3328-865-0x00007FF8E3FC0000-0x00007FF8E3FD0000-memory.dmp
memory/3328-860-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp
memory/3328-861-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp
memory/3328-915-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp
memory/3328-916-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp
memory/3328-914-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp
memory/3328-913-0x00007FF8E6900000-0x00007FF8E6910000-memory.dmp
memory/5208-0-0x0000000001080000-0x0000000001081000-memory.dmp
memory/5208-119-0x0000000000400000-0x0000000000D82000-memory.dmp
memory/5208-1-0x00000000004A0000-0x00000000004A1000-memory.dmp