CrowDoor
Crowdoor is a Windows backdoor/loader family and a variant of SparrowDoor. It has been observed in China-nexus intrusion activity and is associated in the provided reporting with Tropic Trooper, FamousSparrow-linked activity, Earth Estries, UAT-9244, UAT-8302 delivery chains, and reporting that also describes its use by Salt Typhoon. Crowdoor has been delivered through DLL search-order hijacking and side-loading chains, including malicious datast.dll, datastate.dll, VERSION.dll, and BugSplatRc64.dll loaders executed by legitimate binaries such as inst.exe and wsprint.exe; Draculoader is also described as delivering Crowdoor. In one reported chain, a compromised Umbraco CMS server with a .NET China Chopper web shell was used to deploy post-exploitation tooling and loaders that decrypted and executed Crowdoor in memory.
Reported persistence mechanisms include creation of a Windows service such as WinStore, Registry Run key persistence at HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinStore, and more generally Registry Run keys or services. Crowdoor can restart itself by injecting into legitimate processes; the content specifically mentions injection into colorcpl.exe in one campaign and msiexec.exe in newer variants, including remote-memory write and remote-thread creation. The malware performs different actions depending on command-line arguments: with no argument or argument 0 it sets persistence and restarts, with argument 1 it restarts by injecting into msiexec.exe, and with argument 2 it invokes the main backdoor function.
Capabilities directly described in the content include initial C2 connection and communication with a C&C server, remote shell, system information collection (including computer name, username, OS version, and host/IP information), file operations such as open/read, open/write, drive enumeration, file search, directory creation, rename, and delete, and self-removal including deleting malware files, removing persistence, and exiting. One newer variant is described as dropping Cobalt Strike and maintaining persistence. The content also lists Crowdoor-related package names and components including WinStore.exe with Sqlite3.dll, K7Sysmon.exe with K7Sysmn1.dll/K7Sysmn2.dll/K7Sysmn3.dll, HxTsk.exe with d3d8.dll, and MsMsRng.exe with sqlite3.dll and msimg32.dll; some components are noted as stored encrypted.
Victimology in the provided material includes a Middle Eastern government entity, a government entity in Malaysia, government targets in South America and southeastern Europe via related delivery chains, and telecommunications targets in South America. Notable infrastructure and artifacts mentioned include attempted contact to blog.techmersion[.]com over port 443, service/task names such as WinStore and WSPrint, and loader artifacts including WSPrint.dll and WSPrint.sys. TernDoor is explicitly described as a variant of Crowdoor, itself a variant of SparrowDoor.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This attack chain was attempting to load the Crowdoor loader, which is half-named after the SparrowDoor backdoor... The malicious samples are called Crowdoor, which, when run, drop CobaltStrike and maintain persistence.
This attack chain was attempting to load the Crowdoor loader, which is half-named after the SparrowDoor backdoor... The malicious samples are called Crowdoor, which, when run, drop CobaltStrike and maintain persistence.
A variant of Crowdoor (itself a variant of SparrowDoor), the backdoor is said to have been put to use by UAT-9244 since at least November 2024.
TernDoor is a variant of CrowDoor, a backdoor deployed in recent intrusions linked to China-nexus APTs such as FamousSparrow and Earth Estries. CrowDoor is a variant of SparrowDoor...
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
3 techniques
Execution
"However, in some instances, WMIC may be used in its place to achieve similar results."
Persistence
2 techniques
Persistence
Privilege Escalation
3 techniques
Privilege Escalation
When executed, it injects itself into the colorcpl.exe process with the command-line argument “2”... The main loading functionality was designed to execute a legitimate msiexec.exe process, then inject the next stage by writing into its remote address space and creating a remote thread to execute it.
Stealth
4 techniques
Stealth
When executed, it injects itself into the colorcpl.exe process with the command-line argument “2”... The main loading functionality was designed to execute a legitimate msiexec.exe process, then inject the next stage by writing into its remote address space and creating a remote thread to execute it.
This function implements the main functionality for this loader, decrypting the shellcode for the next stage from a memory buffer inside the datastate.dll file using a variant of the RC4 stream cipher.
Discovery
3 techniques
Discovery
Lateral Movement
1 technique
Lateral Movement
Collection
1 technique
Collection
IOCs tracked for this family
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Payload delivered by Draculoader.
Referenced as a related backdoor family (variant lineage: Crowdoor -> SparrowDoor) used for comparison with TernDoor; specific functional details are not provided beyond its relationship/overlap.
Windows backdoor family (and a SparrowDoor variant) used in China-nexus intrusions; TernDoor is described as a newly observed variation with different command codes and an embedded encrypted driver for process control/evasion.
Backdoor that persists via Run-key registry modification and/or Windows service creation; supports process injection (e.g., into msiexec.exe) and encrypted C2 communications with command/tasking capabilities (file ops, remote shell, etc.).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.