Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04-05-2024 17:52

General

  • Target

    dsf.exe

  • Size

    45KB

  • MD5

    78d4c2bd8fdeca5de7dda407fe6c816b

  • SHA1

    d9a2dd3b6e150c2fba96384cdbec3d08c10c381e

  • SHA256

    e37a490b9054a88c18f41fda4c579a8d2546b790386b98b520bd639c687ba7b2

  • SHA512

    4325dd1c53a9381ba6b34b09342640c6c6ba3db6906128bea810c2d03b485846022c1e790f86e641978cf043b772c070aa403d0f2770b1329360de8331c5b52b

  • SSDEEP

    768:NdhO/poiiUcjlJInOaH9Xqk5nWEZ5SbTDa1uI7CPW5c:Dw+jjgnJH9XqcnW85SbTguIk

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

perlaa-63123.portmap.host

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    1000

  • install_path

    temp

  • port

    63123

  • startup_name

    WindowsClient

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dsf.exe
    "C:\Users\Admin\AppData\Local\Temp\dsf.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4988
    • C:\Users\Admin\AppData\Local\Temp\XenoManager\dsf.exe
      "C:\Users\Admin\AppData\Local\Temp\XenoManager\dsf.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4608
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "WindowsClient" /XML "C:\Users\Admin\AppData\Local\Temp\tmp62D1.tmp" /F
        3⤵
        • Creates scheduled task(s)
        PID:1644

Network

  • flag-us
    DNS
    perlaa-63123.portmap.host
    dsf.exe
    Remote address:
    8.8.8.8:53
    Request
    perlaa-63123.portmap.host
    IN A
    Response
    perlaa-63123.portmap.host
    IN A
    193.161.193.99
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    170.117.168.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    170.117.168.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    79.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    79.190.18.2.in-addr.arpa
    IN PTR
    Response
    79.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-79deploystaticakamaitechnologiescom
  • 193.161.193.99:63123
    perlaa-63123.portmap.host
    dsf.exe
    156 B
    120 B
    3
    3
  • 193.161.193.99:63123
    perlaa-63123.portmap.host
    dsf.exe
    156 B
    120 B
    3
    3
  • 193.161.193.99:63123
    perlaa-63123.portmap.host
    dsf.exe
    156 B
    120 B
    3
    3
  • 193.161.193.99:63123
    perlaa-63123.portmap.host
    dsf.exe
    156 B
    120 B
    3
    3
  • 193.161.193.99:63123
    perlaa-63123.portmap.host
    dsf.exe
    156 B
    120 B
    3
    3
  • 193.161.193.99:63123
    perlaa-63123.portmap.host
    dsf.exe
    156 B
    120 B
    3
    3
  • 193.161.193.99:63123
    perlaa-63123.portmap.host
    dsf.exe
    156 B
    120 B
    3
    3
  • 193.161.193.99:63123
    perlaa-63123.portmap.host
    dsf.exe
    156 B
    120 B
    3
    3
  • 193.161.193.99:63123
    perlaa-63123.portmap.host
    dsf.exe
    156 B
    80 B
    3
    2
  • 193.161.193.99:63123
    perlaa-63123.portmap.host
    dsf.exe
    156 B
    120 B
    3
    3
  • 193.161.193.99:63123
    perlaa-63123.portmap.host
    dsf.exe
    156 B
    80 B
    3
    2
  • 193.161.193.99:63123
    perlaa-63123.portmap.host
    dsf.exe
    156 B
    120 B
    3
    3
  • 193.161.193.99:63123
    perlaa-63123.portmap.host
    dsf.exe
    156 B
    120 B
    3
    3
  • 8.8.8.8:53
    perlaa-63123.portmap.host
    dns
    dsf.exe
    71 B
    87 B
    1
    1

    DNS Request

    perlaa-63123.portmap.host

    DNS Response

    193.161.193.99

  • 8.8.8.8:53
    11.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    11.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    170.117.168.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    170.117.168.52.in-addr.arpa

  • 8.8.8.8:53
    79.190.18.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    79.190.18.2.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dsf.exe.log

    Filesize

    226B

    MD5

    957779c42144282d8cd83192b8fbc7cf

    SHA1

    de83d08d2cca06b9ff3d1ef239d6b60b705d25fe

    SHA256

    0d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51

    SHA512

    f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd

  • C:\Users\Admin\AppData\Local\Temp\XenoManager\dsf.exe

    Filesize

    45KB

    MD5

    78d4c2bd8fdeca5de7dda407fe6c816b

    SHA1

    d9a2dd3b6e150c2fba96384cdbec3d08c10c381e

    SHA256

    e37a490b9054a88c18f41fda4c579a8d2546b790386b98b520bd639c687ba7b2

    SHA512

    4325dd1c53a9381ba6b34b09342640c6c6ba3db6906128bea810c2d03b485846022c1e790f86e641978cf043b772c070aa403d0f2770b1329360de8331c5b52b

  • C:\Users\Admin\AppData\Local\Temp\tmp62D1.tmp

    Filesize

    1KB

    MD5

    ec7eefe5bca44cca1be056cfe4016537

    SHA1

    7ce761d72ac71b1b4b661055cc833eb8e832387b

    SHA256

    f2ec7f463528561df9c96d4329ef9f93d1cbe86fb0a0bd59f1a37ba9180b1fca

    SHA512

    7077cc92b1916a04560d873789898d98f918d3fa1df1b75cad5482ac88b4a51fe13d74e586ba7e9325e2070261380547bff2642edce5c8fa4940411b7628babb

  • memory/4608-9-0x0000000073A70000-0x000000007415E000-memory.dmp

    Filesize

    6.9MB

  • memory/4608-12-0x0000000073A70000-0x000000007415E000-memory.dmp

    Filesize

    6.9MB

  • memory/4608-13-0x0000000073A70000-0x000000007415E000-memory.dmp

    Filesize

    6.9MB

  • memory/4988-0-0x0000000073A7E000-0x0000000073A7F000-memory.dmp

    Filesize

    4KB

  • memory/4988-1-0x0000000000A60000-0x0000000000A72000-memory.dmp

    Filesize

    72KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.