Analysis
- max time kernel
150s - max time network
154s - platform
windows7_x64 - resource
win7 - submitted
10/09/2020, 08:49
Static task
static1
Behavioral task
behavioral1
Sample
8320e50369b6d17c6d939347fa762213b491ffed93aa5b54d7fc5e4ad8fbf4d4.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8320e50369b6d17c6d939347fa762213b491ffed93aa5b54d7fc5e4ad8fbf4d4.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 8320e50369b6d17c6d939347fa762213b491ffed93aa5b54d7fc5e4ad8fbf4d4.exe
- Size 365KB
- Sample200910-qkcd2agbt2
- SHA256 8320e50369b6d17c6d939347fa762213b491ffed93aa5b54d7fc5e4ad8fbf4d4
- MD5 5f64cc672ea13388797599b40a62d9be
- SHA1 82523c8c89c052c7bda11b1ad0bf27affd26e906
- SHA512 3c22f98b26826024e378e0e8cf148641d0b1b1d119a97f574ce6fbcd83e4b54b685bb72be1193c1a7b860b34480e88ed1a4ff64af9cc1bafad58e1d6d4ff5cfb
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Bazar Loader 12 IoCs
Detected loader normally used to deploy BazarBackdoor malware.
description flow ioc Process HTTP URL 5 https://85.143.221.85/api/v138 Process not Found HTTP URL 10 https://195.123.241.194/api/v138 Process not Found HTTP URL 13 https://37.220.6.126/api/v138 Process not Found HTTP URL 14 https://37.220.6.126/api/v138 Process not Found HTTP URL 16 https://164.132.76.76/api/v138 Process not Found HTTP URL 15 https://37.220.6.126/api/v138 Process not Found HTTP URL 17 https://164.132.76.76/api/v138 Process not Found Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\SystemCertificates\My 8320e50369b6d17c6d939347fa762213b491ffed93aa5b54d7fc5e4ad8fbf4d4.exe HTTP URL 8 https://85.143.221.85/api/v138 Process not Found HTTP URL 9 https://85.143.221.85/api/v138 Process not Found HTTP URL 11 https://195.123.241.194/api/v138 Process not Found HTTP URL 12 https://195.123.241.194/api/v138 Process not Found - Tries to connect to .bazar domain 11 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
description flow ioc HTTP URL 5 https://85.143.221.85/api/v138 HTTP URL 8 https://85.143.221.85/api/v138 HTTP URL 11 https://195.123.241.194/api/v138 HTTP URL 12 https://195.123.241.194/api/v138 HTTP URL 15 https://37.220.6.126/api/v138 HTTP URL 16 https://164.132.76.76/api/v138 HTTP URL 9 https://85.143.221.85/api/v138 HTTP URL 10 https://195.123.241.194/api/v138 HTTP URL 13 https://37.220.6.126/api/v138 HTTP URL 14 https://37.220.6.126/api/v138 HTTP URL 17 https://164.132.76.76/api/v138