Overview

overview

10

Static

static

fabbde554c...0f.exe

windows7_x64

10

fabbde554c...0f.exe

windows10_x64

10

Analysis

  • max time kernel
    127s
  • max time network
    129s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    10-09-2020 08:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fabbde554c34e111a975534b714cec911f558ca30f9a4057ebdc25314b3a270f.exe

  • Size

    365KB

  • MD5

    157e256ee99b5ae2eb0b4663ea3bd3ca

  • SHA1

    11b315dab07ab1398962596770d9d26e46770f6a

  • SHA256

    fabbde554c34e111a975534b714cec911f558ca30f9a4057ebdc25314b3a270f

  • SHA512

    1bad7c718c09082853559cac0863a63ae6a8ffb37ae2a31435ed603487f2197384b8ab8c055208d7f58716c3f6cd4942d0d4c0bae1673023cbf18fd49cbe1708

Score
10/10
bazarbackdoorbazarloaderbackdoordropperloader

Malware Config

Signatures

  • Bazar Loader 4 IoCs

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • BazarBackdoor

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

    backdoorbazarbackdoor
  • Bazar/Team9 Backdoor payload 3 IoCs
  • Tries to connect to .bazar domain 3 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fabbde554c34e111a975534b714cec911f558ca30f9a4057ebdc25314b3a270f.exe
    "C:\Users\Admin\AppData\Local\Temp\fabbde554c34e111a975534b714cec911f558ca30f9a4057ebdc25314b3a270f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd"
      2⤵
        PID:500
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
      1⤵
      • Bazar Loader
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1504
    • C:\Users\Admin\AppData\Local\Temp\fabbde554c34e111a975534b714cec911f558ca30f9a4057ebdc25314b3a270f.exe
      "C:\Users\Admin\AppData\Local\Temp\fabbde554c34e111a975534b714cec911f558ca30f9a4057ebdc25314b3a270f.exe" -r {D448E590-4126-4AE1-9251-68D2CC94D128}
      1⤵
        PID:2960

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/500-2-0x0000000140000000-0x0000000140040000-memory.dmp

        Filesize

        256KB

        Download

      • memory/500-3-0x0000000140017F2C-mapping.dmp

        Download

      • memory/500-4-0x0000000140000000-0x0000000140040000-memory.dmp

        Filesize

        256KB

        Download

      • memory/796-0-0x000002EE0BEA0000-0x000002EE0BEBF000-memory.dmp

        Filesize

        124KB

        Download

      • memory/796-1-0x0000000140000000-0x0000000140021000-memory.dmp

        Filesize

        132KB

        Download