Backdoor.Win64.ADAPTIX.B

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It connects to a website to send and receive information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Backdoor does not have any propagation routine.

Backdoor Routine

This Backdoor connects to the following websites to send and receive information:

• https://{BLOCKED}ks.ie/api/v2/users/sync
• https://{BLOCKED}ks.ie/assets/js/bundle.js
• https://{BLOCKED}ks.ie/graphql
• https://{BLOCKED}ks.ie/api/v1/telemetry
• https://{BLOCKED}ks.ie/api/v3/metrics/collect
• https://{BLOCKED}ks.ie/v2/heartbeat/ping
• https://{BLOCKED}.{BLOCKED}.210.19

Handles the following built-in commands internally:

• ping → Confirms beacon status and verifies connection to the C2 server
• sleep → Modifies the callback polling interval and jitter settings
• reconnect → Reconnects sockets and refreshes the beacon communication session
• status → Retrieves current session status and active memory footprint
• ls → Lists directory contents and searches files
• upload → Writes incoming files from the C2 server to the local system
• download → Reads and exfiltrates local files to the C2 server
• file_manage → Copies, moves, or deletes local files
• mkdir/rmdir → Creates or removes folders
• cd/pwd → Queries or changes the current working directory
• exec → Spawns arbitrary processes with custom command lines
• ps_monitor → Monitors spawned processes and retrieves exit codes
• kill → Terminates processes by PID using native system calls
• ps → Enumerates running processes and modules
• impersonate → Steals access tokens and impersonates users
• revtoself → Revokes impersonated tokens and restores original process identity
• shell → Launches interactive cmd.exe shell with redirected named pipes
• inject → Allocates memory and executes payloads in a new thread

Rootkit Capabilities

This Backdoor does not have rootkit capabilities.

Information Theft

This Backdoor gathers the following data:

• IP Address
• Username
• Computer Name
• Active Directory / Network domain name
• Host process path
• Process ID (PID)
• Process architecture and bitness (32-bit or 64-bit)
• User Security Identifier (SID)
• User privilege level
• OS version

Other Details

This Backdoor does the following:

• It has the following capabilities:
  • Arbitrary system command execution
  • Credential and access token impersonation
  • File download from server
  • File upload to server
  • Directory navigation and management
  • Process enumeration and termination
  • Interactive command shell via named pipes
  • In-memory shellcode injection and execution
• It is executed by calling its exported function, DLLRegisterServer, via a host process e.g. rundll32.exe or regsvr32.exe.
• It unpacks and executes its core payload directly in memory without dropping files to disk.
• It executes a delay loop to evade sandbox analysis
• It creates the following named pipe for interactive shell execution:
  • \.\pipe\%08lx

It does not exploit any vulnerability.