Analysis
- max time kernel
125s - max time network
127s - platform
windows10_x64 - resource
win10v200722 - submitted
23/09/2020, 20:21
General
- Target Preview.exe
- Size 394KB
- Sample200923-klynrr94js
- SHA256 7b86d02140dd6e4b537d1ca6a7a7ec8df70caaece6db092b13da58633f055f9d
Score
10/10
Malware Config
Signatures
- Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
- BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
- Bazar/Team9 Backdoor payload 1 IoCs
- Bazar/Team9 Loader payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Preview.exe"C:\Users\Admin\AppData\Local\Temp\Preview.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/424-2-0x0000000140000000-0x0000000140040000-memory.dmp
memory/3980-0-0x0000000002000000-0x000000000203C000-memory.dmp
memory/3980-1-0x0000000180000000-0x000000018003F000-memory.dmp