Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 17:52
Behavioral task
behavioral1
Sample
dsf.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
dsf.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
dsf.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
General
-
Target
dsf.exe
-
Size
45KB
-
MD5
78d4c2bd8fdeca5de7dda407fe6c816b
-
SHA1
d9a2dd3b6e150c2fba96384cdbec3d08c10c381e
-
SHA256
e37a490b9054a88c18f41fda4c579a8d2546b790386b98b520bd639c687ba7b2
-
SHA512
4325dd1c53a9381ba6b34b09342640c6c6ba3db6906128bea810c2d03b485846022c1e790f86e641978cf043b772c070aa403d0f2770b1329360de8331c5b52b
-
SSDEEP
768:NdhO/poiiUcjlJInOaH9Xqk5nWEZ5SbTDa1uI7CPW5c:Dw+jjgnJH9XqcnW85SbTguIk
Malware Config
Extracted
xenorat
perlaa-63123.portmap.host
Xeno_rat_nd8912d
-
delay
1000
-
install_path
temp
-
port
63123
-
startup_name
WindowsClient
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2976 dsf.exe -
Loads dropped DLL 1 IoCs
pid Process 1968 dsf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2672 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2752 taskmgr.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2976 1968 dsf.exe 28 PID 1968 wrote to memory of 2976 1968 dsf.exe 28 PID 1968 wrote to memory of 2976 1968 dsf.exe 28 PID 1968 wrote to memory of 2976 1968 dsf.exe 28 PID 2976 wrote to memory of 2672 2976 dsf.exe 29 PID 2976 wrote to memory of 2672 2976 dsf.exe 29 PID 2976 wrote to memory of 2672 2976 dsf.exe 29 PID 2976 wrote to memory of 2672 2976 dsf.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\dsf.exe"C:\Users\Admin\AppData\Local\Temp\dsf.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\XenoManager\dsf.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\dsf.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "WindowsClient" /XML "C:\Users\Admin\AppData\Local\Temp\tmp251D.tmp" /F3⤵
- Creates scheduled task(s)
PID:2672
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ec7eefe5bca44cca1be056cfe4016537
SHA17ce761d72ac71b1b4b661055cc833eb8e832387b
SHA256f2ec7f463528561df9c96d4329ef9f93d1cbe86fb0a0bd59f1a37ba9180b1fca
SHA5127077cc92b1916a04560d873789898d98f918d3fa1df1b75cad5482ac88b4a51fe13d74e586ba7e9325e2070261380547bff2642edce5c8fa4940411b7628babb
-
Filesize
45KB
MD578d4c2bd8fdeca5de7dda407fe6c816b
SHA1d9a2dd3b6e150c2fba96384cdbec3d08c10c381e
SHA256e37a490b9054a88c18f41fda4c579a8d2546b790386b98b520bd639c687ba7b2
SHA5124325dd1c53a9381ba6b34b09342640c6c6ba3db6906128bea810c2d03b485846022c1e790f86e641978cf043b772c070aa403d0f2770b1329360de8331c5b52b