Analysis

  • max time kernel
    15s
  • max time network
    88s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    14/10/2020, 05:50

General

  • Target

    1 (9).exe

  • Size

    5.6MB

  • MD5

    74ae1f78e710ffa4640c5bde890c8bae

  • SHA1

    2626eecb877dffa988e578b7267a808c82d413f7

  • SHA256

    a4b5ccb2649742c9c1070f48b46957585830b0acda29a704b146632b46c99c9e

  • SHA512

    44a6a11c3f94f43501ffb101732e82319d9c8041064fe4bfa5addf6250cdaa4d04106571f240e64689e98fe037428b593231c331ee5e2b16e85e9c7896891751

Score
10/10

Malware Config

Signatures

  • BazarBackdoor 4 IoCs

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

  • Blacklisted process makes network request 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 852 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1 (9).exe
    "C:\Users\Admin\AppData\Local\Temp\1 (9).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe
      2⤵
      • Blacklisted process makes network request
      PID:1460
  • C:\Users\Admin\AppData\Local\Temp\1 (9).exe
    C:\Users\Admin\AppData\Local\Temp\1 (9).exe 1988389199
    1⤵
      PID:316

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1460-5-0x0000000049E10000-0x0000000049E54000-memory.dmp

            Filesize

            272KB

          • memory/1460-7-0x0000000049E10000-0x0000000049E54000-memory.dmp

            Filesize

            272KB

          • memory/1496-0-0x00000000009E0000-0x0000000000A0F000-memory.dmp

            Filesize

            188KB

          • memory/1496-1-0x0000000140000000-0x000000014002D000-memory.dmp

            Filesize

            180KB

          • memory/1588-2-0x000007FEF7DE0000-0x000007FEF805A000-memory.dmp

            Filesize

            2.5MB