Analysis

  • max time kernel
    142s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    03-06-2022 13:29

General

  • Target

    1236.ps1

  • Size

    177KB

  • MD5

    0336381c76595f013baed58abebec38c

  • SHA1

    46b35dc1fe0eca4dc45b35db87d5f6220456df17

  • SHA256

    90f7051bb59f9ee7dbfee8a1fc9882dbba383fbe1e647eff0466830d2ce71ce2

  • SHA512

    d6a3c890d9d6981b8b001b747b1b9b319a4d34e293eaf4d8a9f10b16b5a2af0d94c01fff3b532aa90200561957d2386f89c32eafed4613dda005bc2a6923c7f6

Score
10/10

Malware Config

Signatures

  • DoubleBack

    DoubleBack is a modular backdoor first seen in December 2020.

  • DoubleBack x64 Payload 3 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\1236.ps1
    1⤵
    • Blocklisted process makes network request
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3840
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:3668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3668-138-0x0000008800000000-0x000000880000E000-memory.dmp

    Filesize

    56KB

  • memory/3840-130-0x000001EAEE240000-0x000001EAEE262000-memory.dmp

    Filesize

    136KB

  • memory/3840-131-0x00007FF8F2E60000-0x00007FF8F3921000-memory.dmp

    Filesize

    10.8MB

  • memory/3840-132-0x00007FF8F2E60000-0x00007FF8F3921000-memory.dmp

    Filesize

    10.8MB

  • memory/3840-133-0x000001EAEB8E9000-0x000001EAEB8EF000-memory.dmp

    Filesize

    24KB

  • memory/3840-136-0x000001EAEB400000-0x000001EAEB40A000-memory.dmp

    Filesize

    40KB

  • memory/3840-137-0x0000008800000000-0x000000880000E000-memory.dmp

    Filesize

    56KB

  • memory/3840-134-0x00007FF8F2E60000-0x00007FF8F3921000-memory.dmp

    Filesize

    10.8MB

  • memory/3840-135-0x000001EAEB8E9000-0x000001EAEB8EF000-memory.dmp

    Filesize

    24KB