Overview
overview
10Static
static
102020.10.29...3d.dll
windows7-x64
32020.10.29...3d.dll
windows10-2004-x64
32020.10.29...f8.ps1
windows7-x64
62020.10.29...f8.ps1
windows10-2004-x64
32020.10.29...05.dll
windows7-x64
12020.10.29...05.dll
windows10-2004-x64
12020.10.29...16.dll
windows7-x64
12020.10.29...16.dll
windows10-2004-x64
12020.10.29...42.ps1
windows7-x64
32020.10.29...42.ps1
windows10-2004-x64
3Analysis
-
max time kernel
107s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2025, 10:04
Behavioral task
behavioral1
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/00352afc7e7863530e4d68be35ae8b60261fc57560167645697b7bfc0ac0e93d.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/00352afc7e7863530e4d68be35ae8b60261fc57560167645697b7bfc0ac0e93d.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/134919151466c9292bdcb7c24c32c841a5183d880072b0ad5e8b3a3a830afef8.ps1
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/134919151466c9292bdcb7c24c32c841a5183d880072b0ad5e8b3a3a830afef8.ps1
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/166b1fb3d34b32f1807c710aaa435d181aedbded1e7b4539ffa931c2b2cdd405.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral6
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/166b1fb3d34b32f1807c710aaa435d181aedbded1e7b4539ffa931c2b2cdd405.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/a3170c32c09fc85cdda778a5c20a3dab144b6d1dd9996ba8340866e0081c7642.ps1
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/a3170c32c09fc85cdda778a5c20a3dab144b6d1dd9996ba8340866e0081c7642.ps1
Resource
win10v2004-20250217-en
windows10-2004-x64
General
-
Target
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll
-
Size
1.7MB
-
MD5
faaafa3e115033ba5115ed6a6ba59ba9
-
SHA1
ca16a95cd38707bad2dc524bb3086b3c0cb3e372
-
SHA256
44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316
-
SHA512
6f2fe02c1e15be2409f89ff1e6ae3c78f87e242ee448fe5ff6d375a74f10c7c6cc01f3f6d796aa34599a891e03c5d421d10f0c041e5a6dc0e346aea3ae21a935
-
SSDEEP
49152:jTRjrgdOU9p1PZH/JNTFTJT5dwIwzQJH:PRCBNTBwAH
Malware Config
Signatures
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4768 ipconfig.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command rundll32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4568 rundll32.exe Token: SeDebugPrivilege 4568 rundll32.exe Token: SeDebugPrivilege 4568 rundll32.exe Token: SeDebugPrivilege 4568 rundll32.exe Token: SeDebugPrivilege 4568 rundll32.exe Token: SeDebugPrivilege 4568 rundll32.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 4568 wrote to memory of 4400 4568 rundll32.exe 86 PID 4568 wrote to memory of 4400 4568 rundll32.exe 86 PID 4568 wrote to memory of 116 4568 rundll32.exe 88 PID 4568 wrote to memory of 116 4568 rundll32.exe 88 PID 4568 wrote to memory of 5112 4568 rundll32.exe 90 PID 4568 wrote to memory of 5112 4568 rundll32.exe 90 PID 5112 wrote to memory of 4768 5112 cmd.exe 92 PID 5112 wrote to memory of 4768 5112 cmd.exe 92 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 4156 4568 rundll32.exe 94 PID 4568 wrote to memory of 4156 4568 rundll32.exe 94 PID 4568 wrote to memory of 4156 4568 rundll32.exe 94 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 1572 4568 rundll32.exe 93 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 2208 4568 rundll32.exe 96 PID 4568 wrote to memory of 2208 4568 rundll32.exe 96 PID 4568 wrote to memory of 2208 4568 rundll32.exe 96 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 3648 4568 rundll32.exe 95 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 2400 4568 rundll32.exe 99 PID 4568 wrote to memory of 2400 4568 rundll32.exe 99 PID 4568 wrote to memory of 2400 4568 rundll32.exe 99 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 884 4568 rundll32.exe 98 PID 4568 wrote to memory of 884 4568 rundll32.exe 98
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2020.10.29_CISA-MAR-10310246_Powershell_Backdoor\44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll,#11⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\System32\cmd.exe/c "dir"2⤵PID:4400
-
-
C:\Windows\System32\cmd.exe/c "set"2⤵PID:116
-
-
C:\Windows\System32\cmd.exe/c "ipconfig /all"2⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4768
-
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:1572
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:4156
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:3648
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:2208
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:884
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:2400
-