Analysis
- max time kernel
130s - max time network
130s - platform
windows10_x64 - resource
win10v200722 - submitted
15/09/2020, 20:35
General
- Target Print_Preview.exe
- Size 251KB
- Sample200915-b3xe211kb6
- SHA256 34cc67888cd38da7aeb52508b48ad71287c402aecb72bccca7cbd3a0cd8fe985
Score
10/10
Malware Config
Signatures
- Bazar Loader 7 IoCs
Detected loader normally used to deploy BazarBackdoor malware.
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Print_Preview.exe"C:\Users\Admin\AppData\Local\Temp\Print_Preview.exe"1⤵
- Bazar Loader
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Users\Admin\AppData\Local\Temp\Print_Preview.exe"C:\Users\Admin\AppData\Local\Temp\Print_Preview.exe" -r {E18F1E7C-5C32-44D5-B1C6-38CEDA926C90}1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2096-0-0x00000225C8CE0000-0x00000225C8D08000-memory.dmp
memory/2096-1-0x0000000180000000-0x000000018002A000-memory.dmp
memory/4064-13-0x0000000001FC0000-0x0000000001FE8000-memory.dmp
memory/4064-14-0x0000000180000000-0x000000018002A000-memory.dmp