Edit tour
Windows
Analysis Report
download.ps1
Overview
General Information
| Sample name: | download.ps1 |
| Analysis ID: | 1572542 |
| MD5: | a766c6fe1358b7d441ff94575d3d4eb1 |
| SHA1: | 15d42c28ec43a8470f1027b0dbebe976c623e09a |
| SHA256: | ec7dc800753751c1de3d99e575ea591fe54210fddb48f1bfca88679fbc358c17 |
| Tags: | KongTukeps1user-monitorsg |
| Infos: |   |
 | |
Detection
Python BackDoor
| Score: | 72 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected Python BackDoor
AI detected suspicious sample
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Opens network shares
Powershell drops PE file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Classification
- System is w10x64
powershell.exe (PID: 4836 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -noLogo -E xecutionPo licy unres tricted -f ile "C:\Us ers\user\D esktop\dow nload.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 2096 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
check.exe (PID: 6640 cmdline: "C:\Users\ user\AppDa ta\Roaming \DzIcXtPK\ check.exe" MD5: F17797CAAB0F1CB8D5813853AAD786CA) - check.exe (PID: 1008 cmdline:
"C:\Users\ user\AppDa ta\Roaming \DzIcXtPK\ check.exe" MD5: F17797CAAB0F1CB8D5813853AAD786CA) 
systeminfo.exe (PID: 3800 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD) - conhost.exe (PID: 1020 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 764 cmdline:
C:\Windows \system32\ cmd.exe /c "wmic com putersyste m get manu facturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 6564 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
WMIC.exe (PID: 5064 cmdline: wmic compu tersystem get manufa cturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785) 
WerFault.exe (PID: 1484 cmdline: C:\Windows \system32\ WerFault.e xe -u -p 1 008 -s 940 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
- check.exe (PID: 5716 cmdline:
"C:\Users\ user\AppDa ta\Roaming \DzIcXtPK\ check.exe" MD5: F17797CAAB0F1CB8D5813853AAD786CA) - check.exe (PID: 6704 cmdline:
"C:\Users\ user\AppDa ta\Roaming \DzIcXtPK\ check.exe" MD5: F17797CAAB0F1CB8D5813853AAD786CA) - systeminfo.exe (PID: 6884 cmdline:
systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD) - conhost.exe (PID: 4864 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 1512 cmdline:
C:\Windows \system32\ cmd.exe /c "wmic com putersyste m get manu facturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2960 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - WMIC.exe (PID: 6732 cmdline:
wmic compu tersystem get manufa cturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - WerFault.exe (PID: 424 cmdline:
C:\Windows \system32\ WerFault.e xe -u -p 6 704 -s 976 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
- check.exe (PID: 6084 cmdline:
"C:\Users\ user\AppDa ta\Roaming \DzIcXtPK\ check.exe" MD5: F17797CAAB0F1CB8D5813853AAD786CA) - check.exe (PID: 6724 cmdline:
"C:\Users\ user\AppDa ta\Roaming \DzIcXtPK\ check.exe" MD5: F17797CAAB0F1CB8D5813853AAD786CA) - systeminfo.exe (PID: 7108 cmdline:
systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD) - conhost.exe (PID: 7072 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 420 cmdline:
C:\Windows \system32\ cmd.exe /c "wmic com putersyste m get manu facturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 6244 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - WMIC.exe (PID: 2084 cmdline:
wmic compu tersystem get manufa cturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - WerFault.exe (PID: 3700 cmdline:
C:\Windows \system32\ WerFault.e xe -u -p 6 724 -s 996 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PythonBackDoor_1 | Yara detected Python BackDoor | Joe Security | ||
| JoeSecurity_PythonBackDoor_1 | Yara detected Python BackDoor | Joe Security | ||
| JoeSecurity_PythonBackDoor_1 | Yara detected Python BackDoor | Joe Security | ||
| JoeSecurity_PythonBackDoor_1 | Yara detected Python BackDoor | Joe Security | ||
| JoeSecurity_PythonBackDoor_1 | Yara detected Python BackDoor | Joe Security | ||
| Click to see the 10 entries | ||||
System Summary |   |
|---|
| Source: | Author: frack113: | ||
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Source: | Author: frack113, Nasreddine Bencherchali (Nextron Systems): | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||