bazarbackdoor | 55d95d9486d77df6ac79bb25eb8b8778940bac27021249f779198e05a2e1edae | Triage™

Analysis

max time kernel
140s
max time network
141s
platform
windows10_x64
resource
win10
submitted
16/07/2020, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
55d95d9486d77df6ac79bb25eb8b8778940bac27021249f779198e05a2e1edae.exe
Size 813KB
Sample200716-j7631aqlbn
SHA256 55d95d9486d77df6ac79bb25eb8b8778940bac27021249f779198e05a2e1edae
MD5 dfcf5342f034605cda27d08ce3706d0f
SHA1 d7b744fd876bc7434cab8f72df66d1bc9c7fcd1a
SHA512 df597e3e87138fb585d9ae370a590b96c45bb581899879d5a583efc069656fce3aec2d2687dbd58eb08849de7defc9de0aa7029d78c84aa963b52587187c6008
MD5 SHA1 SHA512

Score

10^/10

backdoor bazarbackdoor

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3820	55d95d9486d77df6ac79bb25eb8b8778940bac27021249f779198e05a2e1edae.exe
3820	55d95d9486d77df6ac79bb25eb8b8778940bac27021249f779198e05a2e1edae.exe

BazarBackdoor
Stealthy backdoor targetting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

C:\Users\Admin\AppData\Local\Temp\55d95d9486d77df6ac79bb25eb8b8778940bac27021249f779198e05a2e1edae.exe
"C:\Users\Admin\AppData\Local\Temp\55d95d9486d77df6ac79bb25eb8b8778940bac27021249f779198e05a2e1edae.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3820-0-0x0000000002200000-0x000000000222E000-memory.dmp

Download