Overview
overview
10Static
static
102020.10.29...3d.dll
windows7-x64
32020.10.29...3d.dll
windows10-2004-x64
32020.10.29...f8.ps1
windows7-x64
62020.10.29...f8.ps1
windows10-2004-x64
32020.10.29...05.dll
windows7-x64
12020.10.29...05.dll
windows10-2004-x64
12020.10.29...16.dll
windows7-x64
12020.10.29...16.dll
windows10-2004-x64
12020.10.29...42.ps1
windows7-x64
32020.10.29...42.ps1
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/02/2025, 10:11
Behavioral task
behavioral1
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/00352afc7e7863530e4d68be35ae8b60261fc57560167645697b7bfc0ac0e93d.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/00352afc7e7863530e4d68be35ae8b60261fc57560167645697b7bfc0ac0e93d.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/134919151466c9292bdcb7c24c32c841a5183d880072b0ad5e8b3a3a830afef8.ps1
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/134919151466c9292bdcb7c24c32c841a5183d880072b0ad5e8b3a3a830afef8.ps1
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/166b1fb3d34b32f1807c710aaa435d181aedbded1e7b4539ffa931c2b2cdd405.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/166b1fb3d34b32f1807c710aaa435d181aedbded1e7b4539ffa931c2b2cdd405.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/a3170c32c09fc85cdda778a5c20a3dab144b6d1dd9996ba8340866e0081c7642.ps1
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/a3170c32c09fc85cdda778a5c20a3dab144b6d1dd9996ba8340866e0081c7642.ps1
Resource
win10v2004-20250217-en
windows10-2004-x64
General
-
Target
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll
-
Size
1.7MB
-
MD5
faaafa3e115033ba5115ed6a6ba59ba9
-
SHA1
ca16a95cd38707bad2dc524bb3086b3c0cb3e372
-
SHA256
44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316
-
SHA512
6f2fe02c1e15be2409f89ff1e6ae3c78f87e242ee448fe5ff6d375a74f10c7c6cc01f3f6d796aa34599a891e03c5d421d10f0c041e5a6dc0e346aea3ae21a935
-
SSDEEP
49152:jTRjrgdOU9p1PZH/JNTFTJT5dwIwzQJH:PRCBNTBwAH
Malware Config
Signatures
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2808 ipconfig.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command rundll32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2596 rundll32.exe Token: SeDebugPrivilege 2596 rundll32.exe Token: SeDebugPrivilege 2596 rundll32.exe Token: SeDebugPrivilege 2596 rundll32.exe Token: SeDebugPrivilege 2596 rundll32.exe Token: SeDebugPrivilege 2596 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2464 2596 rundll32.exe 30 PID 2596 wrote to memory of 2464 2596 rundll32.exe 30 PID 2596 wrote to memory of 2464 2596 rundll32.exe 30 PID 2596 wrote to memory of 1868 2596 rundll32.exe 32 PID 2596 wrote to memory of 1868 2596 rundll32.exe 32 PID 2596 wrote to memory of 1868 2596 rundll32.exe 32 PID 2596 wrote to memory of 2308 2596 rundll32.exe 34 PID 2596 wrote to memory of 2308 2596 rundll32.exe 34 PID 2596 wrote to memory of 2308 2596 rundll32.exe 34 PID 2308 wrote to memory of 2808 2308 cmd.exe 36 PID 2308 wrote to memory of 2808 2308 cmd.exe 36 PID 2308 wrote to memory of 2808 2308 cmd.exe 36 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 2320 2596 rundll32.exe 38 PID 2596 wrote to memory of 2320 2596 rundll32.exe 38 PID 2596 wrote to memory of 2320 2596 rundll32.exe 38 PID 2596 wrote to memory of 2320 2596 rundll32.exe 38 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 272 2596 rundll32.exe 37 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2064 2596 rundll32.exe 41 PID 2596 wrote to memory of 2064 2596 rundll32.exe 41 PID 2596 wrote to memory of 2064 2596 rundll32.exe 41 PID 2596 wrote to memory of 2064 2596 rundll32.exe 41 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 2592 2596 rundll32.exe 40 PID 2596 wrote to memory of 1164 2596 rundll32.exe 42 PID 2596 wrote to memory of 1164 2596 rundll32.exe 42 PID 2596 wrote to memory of 1164 2596 rundll32.exe 42 PID 2596 wrote to memory of 1748 2596 rundll32.exe 43 PID 2596 wrote to memory of 1748 2596 rundll32.exe 43 PID 2596 wrote to memory of 1748 2596 rundll32.exe 43 PID 2596 wrote to memory of 1748 2596 rundll32.exe 43 PID 2596 wrote to memory of 1164 2596 rundll32.exe 42 PID 2596 wrote to memory of 1164 2596 rundll32.exe 42 PID 2596 wrote to memory of 1164 2596 rundll32.exe 42 PID 2596 wrote to memory of 1164 2596 rundll32.exe 42 PID 2596 wrote to memory of 1164 2596 rundll32.exe 42
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2020.10.29_CISA-MAR-10310246_Powershell_Backdoor\44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll,#11⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\System32\cmd.exe/c "dir"2⤵PID:2464
-
-
C:\Windows\System32\cmd.exe/c "set"2⤵PID:1868
-
-
C:\Windows\System32\cmd.exe/c "ipconfig /all"2⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2808
-
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:272
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:2320
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:2592
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:2064
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:1164
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:1748
-