Analysis
- max time kernel
125s - max time network
127s - platform
windows10_x64 - resource
win10 - submitted
03/10/2020, 03:32
General
- Target d2a4ec710165059263815e2e0637da70d1f6aedef38cdb516d7746da018a1ad4.exe
- Size 1.3MB
- Sample201003-3as3ecqmen
- SHA256 d2a4ec710165059263815e2e0637da70d1f6aedef38cdb516d7746da018a1ad4
Score
10/10
Malware Config
Signatures
- Bazar Loader 4 IoCs
Detected loader normally used to deploy BazarBackdoor malware.
- Bazar/Team9 Loader payload 2 IoCs
- Tries to connect to .bazar domain 3 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2a4ec710165059263815e2e0637da70d1f6aedef38cdb516d7746da018a1ad4.exe"C:\Users\Admin\AppData\Local\Temp\d2a4ec710165059263815e2e0637da70d1f6aedef38cdb516d7746da018a1ad4.exe"1⤵
- Bazar Loader
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1576-2-0x0000000140000000-0x0000000140043000-memory.dmp
memory/3588-0-0x0000000000750000-0x0000000000789000-memory.dmp
memory/3588-1-0x0000000180000000-0x0000000180040000-memory.dmp