Analysis
-
max time kernel
70s -
max time network
113s -
platform
windows7_x64 -
resource
win7 -
submitted
10-09-2020 08:49
Static task
static1
Behavioral task
behavioral1
Sample
e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe
Resource
win7
Behavioral task
behavioral2
Sample
e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe
Resource
win10
General
-
Target
e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe
-
Size
379KB
-
MD5
9f00d78f2e8e4523773a264f85be1c02
-
SHA1
3c542144a7a03134060bd666206a106bcea95e5a
-
SHA256
e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e
-
SHA512
5760967703d0702d4c855b75c895a2432c809ca8f945f2a80914f21b3c8129c4bbf155bac4bb5fa6b03e868b3d33cfbe1b3321a7b438741cd62d1c3323d38928
Malware Config
Signatures
-
Bazar Loader 14 IoCs
Detected loader normally used to deploy BazarBackdoor malware.
Processes:
e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exedescription flow ioc HTTP URL 7 https://82.146.37.128/api/v154 HTTP User-Agent header 8 Win HTTP URL 9 https://82.146.37.128/api/v154 HTTP User-Agent header 11 Win HTTP User-Agent header 4 Win HTTP URL 4 https://82.146.37.128/api/v153 HTTP URL 8 https://82.146.37.128/api/v154 HTTP URL 11 https://82.146.37.128/api/v156 HTTP User-Agent header 14 Win Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe HTTP User-Agent header 9 Win HTTP User-Agent header 12 Win HTTP User-Agent header 15 Win HTTP User-Agent header 7 Win -
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Executes dropped EXE 1 IoCs
Processes:
shpgmfthgd.exepid process 1964 shpgmfthgd.exe -
Loads dropped DLL 1 IoCs
Processes:
e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exepid process 1500 e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Skype Remote Control = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe" e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
shpgmfthgd.exedescription pid process target process PID 1964 set thread context of 1148 1964 shpgmfthgd.exe explorer.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2004 timeout.exe -
Suspicious use of WriteProcessMemory 831 IoCs
Processes:
e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.execmd.exeshpgmfthgd.exedescription pid process target process PID 1500 wrote to memory of 1732 1500 e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe cmd.exe PID 1500 wrote to memory of 1732 1500 e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe cmd.exe PID 1500 wrote to memory of 1732 1500 e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe cmd.exe PID 1732 wrote to memory of 2004 1732 cmd.exe timeout.exe PID 1732 wrote to memory of 2004 1732 cmd.exe timeout.exe PID 1732 wrote to memory of 2004 1732 cmd.exe timeout.exe PID 1500 wrote to memory of 1964 1500 e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe shpgmfthgd.exe PID 1500 wrote to memory of 1964 1500 e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe shpgmfthgd.exe PID 1500 wrote to memory of 1964 1500 e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe shpgmfthgd.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe PID 1964 wrote to memory of 1148 1964 shpgmfthgd.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe"C:\Users\Admin\AppData\Local\Temp\e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe"1⤵
- Bazar Loader
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c TIMEOUT /T 50 /NOBREAK && move "C:\Users\Admin\AppData\Local\Temp\lkuttqbctx" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Control Panel.lnk"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exeTIMEOUT /T 50 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\shpgmfthgd.exeC:\Users\Admin\AppData\Local\Temp\shpgmfthgd.exe /NO_AUTOSTART 82.146.37.1282⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
-
C:\Users\Admin\AppData\Local\Temp\lkuttqbctx
-
C:\Users\Admin\AppData\Local\Temp\shpgmfthgd.exe
-
\Users\Admin\AppData\Local\Temp\shpgmfthgd.exe
-
memory/936-13-0x000007FEF65F0000-0x000007FEF686A000-memory.dmpFilesize
2.5MB
-
memory/1148-9-0x00000000FF1A0000-0x00000000FF25D000-memory.dmpFilesize
756KB
-
memory/1148-10-0x00000000FF23B824-mapping.dmp
-
memory/1148-11-0x00000000FF1A0000-0x00000000FF25D000-memory.dmpFilesize
756KB
-
memory/1500-0-0x0000000001D80000-0x0000000001DB3000-memory.dmpFilesize
204KB
-
memory/1500-1-0x0000000001DC0000-0x0000000001DF2000-memory.dmpFilesize
200KB
-
memory/1732-2-0x0000000000000000-mapping.dmp
-
memory/1964-5-0x0000000000000000-mapping.dmp
-
memory/2004-3-0x0000000000000000-mapping.dmp