TwizAdmin Infostealer, DinDoor Backdoor, and ClickFix Attacks: Multi-Platform Threat Analysis

title: Potential DinDoor Backdoor Activity via Deno Runtime
id: 9e2a4b1c-8d3e-4a1f-9c5d-2b6a8c7d1e0f
description: Detects the execution of Deno runtime processes often associated with DinDoor backdoor activity following MSI installation.
status: experimental
date: 2026/04/25
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\deno.exe'
      - '\\deno'
    CommandLine|contains:
      - 'run'
      - 'eval'
  condition: selection
falsepositives:
  - Legitimate developer usage of Deno runtime
level: high
tags:
  - attack.execution
  - attack.t1059.006
  - apt.muddywater
  - malware.dindoor
---
title: TwizAdmin Crypto Clipper C2 Traffic
id: f1c2d3e4-5678-90ab-cdef-1234567890ab
description: Detects potential network connections to FastAPI-based panels associated with TwizAdmin on port 1337.
status: experimental
date: 2026/04/25
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 1337
    Initiated: 'true'
  filter:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection and not filter
falsepositives:
  - Legitimate local development on FastAPI
level: medium
tags:
  - attack.command_and_control
  - attack.t1071.001
  - malware.twizadmin
---
title: ClickFix Social Engineering Pattern
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
description: Detects suspicious PowerShell execution spawned by browsers indicative of ClickFix campaigns.
status: experimental
date: 2026/04/25
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\\chrome.exe'
      - '\\msedge.exe'
      - '\\firefox.exe'
    Image|endswith:
      - '\\powershell.exe'
      - '\\cmd.exe'
    CommandLine|contains:
      - 'copy'
      - 'clipboard'
      - 'iex'
      - 'Invoke-Expression'
  condition: selection
falsepositives:
  - Administrative scripts launched by IT staff
level: high
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.t1204.002


kql
// Hunt for DinDoor processes and TwizAdmin network indicators
let MaliciousHashes = pack_array(
  "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
  "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
  "2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5"
);
let SuspiciousDomains = pack_array(
  "fanonlyatn.xyz", "ineracaspsl.site", "serialmenot.com", "ustazazharidrus.com"
);
// Hunt for File Hash Matches
DeviceProcessEvents
| where FolderPath has_any (MaliciousHashes) or SHA256 has_any (MaliciousHashes)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256
| union (
  // Hunt for Deno Runtime Execution
  DeviceProcessEvents
  | where FileName has "deno"
  | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
  )
| union (
  // Hunt for Network Connections to C2
  DeviceNetworkEvents
  | where RemoteUrl has_any (SuspiciousDomains) or RemoteIP == "31.31.198.206"
  | project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName
  )


powershell
# IOC Hunt Script for TwizAdmin and DinDoor
# Requires Administrator privileges

Write-Host "Starting Hunt for TwizAdmin/DinDoor Indicators..." -ForegroundColor Cyan

$IOC_Hashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
    "584796212f99efc7ac765d6048913fe34e46a64b13a8a78fb3a465b8c61f3527",
    "74ab520e94b2f3b8915ec7b47abab7a2d7e9759add5aa195af7edf0ffa5b4150",
    "2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5"
)

$IOC_Domains = @(
    "fanonlyatn.xyz",
    "ineracaspsl.site",
    "serialmenot.com",
    "justtalken.com"
)

# 1. Scan running processes for Deno (DinDoor) or Suspicious Names
Write-Host "Checking for Suspicious Processes..." -ForegroundColor Yellow
$suspiciousProcs = Get-Process | Where-Object {$_.ProcessName -like "*deno*" -or $_.ProcessName -like "*twiz*"}
if ($suspiciousProcs) {
    Write-Host "ALERT: Found suspicious processes:" -ForegroundColor Red
    $suspiciousProcs | Format-Table Id, ProcessName, Path
} else {
    Write-Host "No suspicious processes found." -ForegroundColor Green
}

# 2. Scan specific directories (User Downloads, AppData) for IOCs
Write-Host "Scanning common directories for known malicious hashes..." -ForegroundColor Yellow
$pathsToScan = @("$env:USERPROFILE\Downloads", "$env:APPDATA", "$env:TEMP")

foreach ($path in $pathsToScan) {
    if (Test-Path $path) {
        Get-ChildItem $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $file = $_
            try {
                $hash = (Get-FileHash -Path $file.FullName -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
                if ($IOC_Hashes -contains $hash) {
                    Write-Host "MALICIOUS FILE FOUND: $($file.FullName)" -ForegroundColor Red
                }
            } catch {
                # Ignore access errors
            }
        }
    }
}

# 3. Check Hosts File for C2 Domains
Write-Host "Checking HOSTS file for C2 domains..." -ForegroundColor Yellow
$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $hostsPath) {
    $hostsContent = Get-Content $hostsPath
    foreach ($domain in $IOC_Domains) {
        if ($hostsContent -match $domain) {
            Write-Host "WARNING: C2 Domain '$domain' found in HOSTS file." -ForegroundColor Red
        }
    }
}

Write-Host "Hunt Complete." -ForegroundColor Cyan