Overview
overview
10Static
static
102020.10.29...3d.dll
windows7-x64
32020.10.29...3d.dll
windows10-2004-x64
32020.10.29...f8.ps1
windows7-x64
62020.10.29...f8.ps1
windows10-2004-x64
32020.10.29...05.dll
windows7-x64
12020.10.29...05.dll
windows10-2004-x64
12020.10.29...16.dll
windows7-x64
12020.10.29...16.dll
windows10-2004-x64
12020.10.29...42.ps1
windows7-x64
32020.10.29...42.ps1
windows10-2004-x64
3Analysis
-
max time kernel
132s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2025, 10:11
Behavioral task
behavioral1
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/00352afc7e7863530e4d68be35ae8b60261fc57560167645697b7bfc0ac0e93d.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/00352afc7e7863530e4d68be35ae8b60261fc57560167645697b7bfc0ac0e93d.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/134919151466c9292bdcb7c24c32c841a5183d880072b0ad5e8b3a3a830afef8.ps1
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/134919151466c9292bdcb7c24c32c841a5183d880072b0ad5e8b3a3a830afef8.ps1
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/166b1fb3d34b32f1807c710aaa435d181aedbded1e7b4539ffa931c2b2cdd405.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/166b1fb3d34b32f1807c710aaa435d181aedbded1e7b4539ffa931c2b2cdd405.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/a3170c32c09fc85cdda778a5c20a3dab144b6d1dd9996ba8340866e0081c7642.ps1
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/a3170c32c09fc85cdda778a5c20a3dab144b6d1dd9996ba8340866e0081c7642.ps1
Resource
win10v2004-20250217-en
windows10-2004-x64
General
-
Target
2020.10.29_CISA-MAR-10310246_Powershell_Backdoor/44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll
-
Size
1.7MB
-
MD5
faaafa3e115033ba5115ed6a6ba59ba9
-
SHA1
ca16a95cd38707bad2dc524bb3086b3c0cb3e372
-
SHA256
44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316
-
SHA512
6f2fe02c1e15be2409f89ff1e6ae3c78f87e242ee448fe5ff6d375a74f10c7c6cc01f3f6d796aa34599a891e03c5d421d10f0c041e5a6dc0e346aea3ae21a935
-
SSDEEP
49152:jTRjrgdOU9p1PZH/JNTFTJT5dwIwzQJH:PRCBNTBwAH
Malware Config
Signatures
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2984 ipconfig.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command rundll32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4920 rundll32.exe Token: SeDebugPrivilege 4920 rundll32.exe Token: SeDebugPrivilege 4920 rundll32.exe Token: SeDebugPrivilege 4920 rundll32.exe Token: SeDebugPrivilege 4920 rundll32.exe Token: SeDebugPrivilege 4920 rundll32.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 4920 wrote to memory of 3828 4920 rundll32.exe 87 PID 4920 wrote to memory of 3828 4920 rundll32.exe 87 PID 4920 wrote to memory of 2040 4920 rundll32.exe 89 PID 4920 wrote to memory of 2040 4920 rundll32.exe 89 PID 4920 wrote to memory of 1484 4920 rundll32.exe 91 PID 4920 wrote to memory of 1484 4920 rundll32.exe 91 PID 1484 wrote to memory of 2984 1484 cmd.exe 93 PID 1484 wrote to memory of 2984 1484 cmd.exe 93 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 3612 4920 rundll32.exe 95 PID 4920 wrote to memory of 3612 4920 rundll32.exe 95 PID 4920 wrote to memory of 3612 4920 rundll32.exe 95 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 4900 4920 rundll32.exe 94 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 3176 4920 rundll32.exe 97 PID 4920 wrote to memory of 3176 4920 rundll32.exe 97 PID 4920 wrote to memory of 3176 4920 rundll32.exe 97 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1188 4920 rundll32.exe 96 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 4004 4920 rundll32.exe 99 PID 4920 wrote to memory of 4004 4920 rundll32.exe 99 PID 4920 wrote to memory of 4004 4920 rundll32.exe 99 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98 PID 4920 wrote to memory of 1912 4920 rundll32.exe 98
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2020.10.29_CISA-MAR-10310246_Powershell_Backdoor\44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316.dll,#11⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\System32\cmd.exe/c "dir"2⤵PID:3828
-
-
C:\Windows\System32\cmd.exe/c "set"2⤵PID:2040
-
-
C:\Windows\System32\cmd.exe/c "ipconfig /all"2⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2984
-
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:4900
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:3612
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:1188
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:3176
-
-
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe"2⤵PID:1912
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:4004
-