Analysis

  • max time kernel
    18s
  • max time network
    82s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    14/10/2020, 05:51

General

  • Target

    1 (2).exe

  • Size

    5.4MB

  • MD5

    bb936ca806d32ba86d4c4c5069c24745

  • SHA1

    bd61de6217556c3923e645043254b782e400b978

  • SHA256

    8fbb33ae75d79566d8a3682d500be2668376e1a79b193ca0d1d6a280822cb0f6

  • SHA512

    8bb865e0b12e999b61947a691fb6959f966518d9e2c46c2d2abd69375e5ac1fc38906c550952c4b5dd9ee1e21c5bbe164e5028a4247902801a0edfcd8e31dd3a

Score
10/10

Malware Config

Signatures

  • BazarBackdoor 4 IoCs

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

  • Blacklisted process makes network request 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 852 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1 (2).exe
    "C:\Users\Admin\AppData\Local\Temp\1 (2).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe
      2⤵
      • Blacklisted process makes network request
      PID:1896
  • C:\Users\Admin\AppData\Local\Temp\1 (2).exe
    C:\Users\Admin\AppData\Local\Temp\1 (2).exe 3338379438
    1⤵
      PID:1976

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1108-0-0x00000000024D0000-0x00000000024FF000-memory.dmp

            Filesize

            188KB

          • memory/1108-1-0x0000000140000000-0x000000014002D000-memory.dmp

            Filesize

            180KB

          • memory/1220-2-0x000007FEF7770000-0x000007FEF79EA000-memory.dmp

            Filesize

            2.5MB

          • memory/1896-3-0x000000004AA80000-0x000000004AAC4000-memory.dmp

            Filesize

            272KB

          • memory/1896-5-0x000000004AA80000-0x000000004AAC4000-memory.dmp

            Filesize

            272KB