bazarloader | d2a4ec710165059263815e2e0637da70d1f6aedef38cdb516d7746da018a1ad4

General

Target
d2a4ec710165059263815e2e0637da70d1f6aedef38cdb516d7746da018a1ad4.exe
Size 1.3MB
Sample201003-3as3ecqmen
SHA256 d2a4ec710165059263815e2e0637da70d1f6aedef38cdb516d7746da018a1ad4
MD5 b5552cba4d3433a0183ede8baaf30cd2
SHA1 f1238029ae17191eda506183757329380ffbb943
SHA512 0728c529371d89fdb94b51a3a4269ee34a45d2f5e4ae6b71610782b1c9edefbf7a8c726a3adc751fcec6cd534ecde3d6adf037df5e7f7a2e2912915a621bb835
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader 10 IoCs

Detected loader normally used to deploy BazarBackdoor malware.

loader dropper bazarloader

description	flow	ioc	Process
HTTP URL	11	https://grd015.com/api/v202	Process not Found
HTTP URL	14	https://grd016.com/api/v202	Process not Found
HTTP URL	15	https://grd016.com/api/v202	Process not Found
HTTP URL	17	https://grd017.com/api/v202	Process not Found
HTTP URL	19	https://grd017.com/api/v202	Process not Found
Key created		\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\SystemCertificates\My	d2a4ec710165059263815e2e0637da70d1f6aedef38cdb516d7746da018a1ad4.exe
HTTP URL	5	https://grd015.com/api/v202	Process not Found
HTTP URL	10	https://grd015.com/api/v202	Process not Found
HTTP URL	13	https://grd016.com/api/v202	Process not Found
HTTP URL	18	https://grd017.com/api/v202	Process not Found

Bazar/Team9 Loader payload 2 IoCs

resource	yara_rule
behavioral1/memory/1620-0-0x00000000020F0000-0x0000000002129000-memory.dmp	BazarLoaderVar4
behavioral1/memory/1620-1-0x0000000180000000-0x0000000180040000-memory.dmp	BazarLoaderVar4

Tries to connect to .bazar domain 9 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

description	flow	ioc
HTTP URL	5	https://grd015.com/api/v202
HTTP URL	10	https://grd015.com/api/v202
HTTP URL	11	https://grd015.com/api/v202
HTTP URL	13	https://grd016.com/api/v202
HTTP URL	14	https://grd016.com/api/v202
HTTP URL	15	https://grd016.com/api/v202
HTTP URL	17	https://grd017.com/api/v202
HTTP URL	18	https://grd017.com/api/v202
HTTP URL	19	https://grd017.com/api/v202

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	d2a4ec710165059263815e2e0637da70d1f6aedef38cdb516d7746da018a1ad4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	d2a4ec710165059263815e2e0637da70d1f6aedef38cdb516d7746da018a1ad4.exe

C:\Users\Admin\AppData\Local\Temp\d2a4ec710165059263815e2e0637da70d1f6aedef38cdb516d7746da018a1ad4.exe
"C:\Users\Admin\AppData\Local\Temp\d2a4ec710165059263815e2e0637da70d1f6aedef38cdb516d7746da018a1ad4.exe"
1⤵
- Bazar Loader
- Modifies system certificate store
PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-0-0x00000000020F0000-0x0000000002129000-memory.dmp

Download

memory/1620-1-0x0000000180000000-0x0000000180040000-memory.dmp