Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04-05-2024 17:52
Behavioral task
behavioral1
Sample
dsf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dsf.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
dsf.exe
Resource
win10v2004-20240419-en
General
-
Target
dsf.exe
-
Size
45KB
-
MD5
78d4c2bd8fdeca5de7dda407fe6c816b
-
SHA1
d9a2dd3b6e150c2fba96384cdbec3d08c10c381e
-
SHA256
e37a490b9054a88c18f41fda4c579a8d2546b790386b98b520bd639c687ba7b2
-
SHA512
4325dd1c53a9381ba6b34b09342640c6c6ba3db6906128bea810c2d03b485846022c1e790f86e641978cf043b772c070aa403d0f2770b1329360de8331c5b52b
-
SSDEEP
768:NdhO/poiiUcjlJInOaH9Xqk5nWEZ5SbTDa1uI7CPW5c:Dw+jjgnJH9XqcnW85SbTguIk
Malware Config
Extracted
xenorat
perlaa-63123.portmap.host
Xeno_rat_nd8912d
-
delay
1000
-
install_path
temp
-
port
63123
-
startup_name
WindowsClient
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4608 dsf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1644 schtasks.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4988 wrote to memory of 4608 4988 dsf.exe 72 PID 4988 wrote to memory of 4608 4988 dsf.exe 72 PID 4988 wrote to memory of 4608 4988 dsf.exe 72 PID 4608 wrote to memory of 1644 4608 dsf.exe 73 PID 4608 wrote to memory of 1644 4608 dsf.exe 73 PID 4608 wrote to memory of 1644 4608 dsf.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\dsf.exe"C:\Users\Admin\AppData\Local\Temp\dsf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\XenoManager\dsf.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\dsf.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "WindowsClient" /XML "C:\Users\Admin\AppData\Local\Temp\tmp62D1.tmp" /F3⤵
- Creates scheduled task(s)
PID:1644
-
-
Network
-
Remote address:8.8.8.8:53Requestperlaa-63123.portmap.hostIN AResponseperlaa-63123.portmap.hostIN A193.161.193.99
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request170.117.168.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request79.190.18.2.in-addr.arpaIN PTRResponse79.190.18.2.in-addr.arpaIN PTRa2-18-190-79deploystaticakamaitechnologiescom
-
156 B 120 B 3 3
-
156 B 120 B 3 3
-
156 B 120 B 3 3
-
156 B 120 B 3 3
-
156 B 120 B 3 3
-
156 B 120 B 3 3
-
156 B 120 B 3 3
-
156 B 120 B 3 3
-
156 B 80 B 3 2
-
156 B 120 B 3 3
-
156 B 80 B 3 2
-
156 B 120 B 3 3
-
156 B 120 B 3 3
-
71 B 87 B 1 1
DNS Request
perlaa-63123.portmap.host
DNS Response
193.161.193.99
-
72 B 158 B 1 1
DNS Request
11.227.111.52.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
170.117.168.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
79.190.18.2.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5957779c42144282d8cd83192b8fbc7cf
SHA1de83d08d2cca06b9ff3d1ef239d6b60b705d25fe
SHA2560d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51
SHA512f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd
-
Filesize
45KB
MD578d4c2bd8fdeca5de7dda407fe6c816b
SHA1d9a2dd3b6e150c2fba96384cdbec3d08c10c381e
SHA256e37a490b9054a88c18f41fda4c579a8d2546b790386b98b520bd639c687ba7b2
SHA5124325dd1c53a9381ba6b34b09342640c6c6ba3db6906128bea810c2d03b485846022c1e790f86e641978cf043b772c070aa403d0f2770b1329360de8331c5b52b
-
Filesize
1KB
MD5ec7eefe5bca44cca1be056cfe4016537
SHA17ce761d72ac71b1b4b661055cc833eb8e832387b
SHA256f2ec7f463528561df9c96d4329ef9f93d1cbe86fb0a0bd59f1a37ba9180b1fca
SHA5127077cc92b1916a04560d873789898d98f918d3fa1df1b75cad5482ac88b4a51fe13d74e586ba7e9325e2070261380547bff2642edce5c8fa4940411b7628babb