xred | df3fa65c4a52fa65513978fc1faad32dd0d35d7282c6e825c54eb4b2473be397

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/10/2026, 20:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-08_fee1fa430cab69133b59b946e85e0cac_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader.exe
Size 1.2MB
Sample261008-yv3dkatsct
SHA256 df3fa65c4a52fa65513978fc1faad32dd0d35d7282c6e825c54eb4b2473be397
MD5 fee1fa430cab69133b59b946e85e0cac
SHA1 a4272cb8459eb7679bdc1de214cff53beeb5572d
SHA512 807b6641e758f62413c8b649d0a54a92a23850c449c7d9c60bc0f06648cb7f537954bc337d4cdc3bc77ab079d8b0064953ce690e757a19c4a05f586e14e03997
SSDEEP 24576:LnsJ39LyjbJkQFMhmC+6GD9LYhICL7qLyrYJ9mi:LnsHyjtk2MYC5GD0IhkYJ9mi
TLSH
T16F458E21F2D18036E572167C5D6BA2689829BEA12F3875CB77E51ECC4F396C16C322D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery xred persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Executes dropped EXE 3 IoCs

pid	Process
2708	._cache_2026-10-08_fee1fa430cab69133b59b946e85e0cac_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader.exe
6068	Synaptics.exe
2436	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	2026-10-08_fee1fa430cab69133b59b946e85e0cac_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-08_fee1fa430cab69133b59b946e85e0cac_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_2026-10-08_fee1fa430cab69133b59b946e85e0cac_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Synaptics.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 2708	5060	2026-10-08_fee1fa430cab69133b59b946e85e0cac_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader.exe	91
PID 5060 wrote to memory of 6068	5060	2026-10-08_fee1fa430cab69133b59b946e85e0cac_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-10-08_fee1fa430cab69133b59b946e85e0cac_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-08_fee1fa430cab69133b59b946e85e0cac_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\._cache_2026-10-08_fee1fa430cab69133b59b946e85e0cac_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_2026-10-08_fee1fa430cab69133b59b946e85e0cac_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2708
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:6068

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 753KB
SHA256 ac68803cc90b41a9c932d995ad2851447adcd2638ae977293428e582ac4b30ad
MD5 110eeb54baed4fdca3bfe3469d9531bf
SHA1 b89c1ff4c6c0fcf2f62cc73487b42f456cd977be
SHA512 5c483dda50c725af4da0fab5f15001bc7a369483cac073480750c2e2689326926e481529eba9a96d28efc11977556e3cd310140ec8ab0c542fc2b7edee5c5628
SSDEEP 12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Icsr:ansJ39LyjbJkQFMhmC+6GD98
TLSH
T1FCF47D32F2D19437D1721A3D9C6BA3A5582ABE512E38794E3BF81E4C5F3D68238152D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_2026-10-08_fee1fa430cab69133b59b946e85e0cac_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-10-08_fee1fa430cab69133b59b946e85e0cac_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader.exe
Size 441KB
SHA256 dab58e248daa799ddd953282b04f5d894c31a92447ca03b22a6fe517110c3313
MD5 884c4cfc21a8d998bf7ea38cb36e0b3a
SHA1 be64dcfe023503ba4d05e1a549d18e1f0b5e792c
SHA512 11187645e1f8ada3a91cc94b0bdaea1a6e2a4c2039fc5f4f4baeeb5df948137e20b244ddc95587c468d846534c1103fcbbe835bd6b72c7462f2481e76313303d
SSDEEP 6144:DY7fsy6S2Wir/Tezp4F36avvAk2qZhyuo0kn9Z1RtYJ9mC7W:DYrdl2WaM4FKLk2qLyx7FRtYJ9m2
TLSH
T149A44B10B7A0C035F9F611F86AAAE13DE42EBAF1672860CB61D513ED56746E46C33393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2436-76-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/2708-35-0x0000000000FB0000-0x0000000001052000-memory.dmp

Download

memory/5060-0-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/5060-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/5060-72-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/6068-74-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/6068-77-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads