Analysis

  • max time kernel
    14s
  • max time network
    114s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    14/10/2020, 05:51

General

  • Target

    1 (2).exe

  • Size

    5.4MB

  • MD5

    bb936ca806d32ba86d4c4c5069c24745

  • SHA1

    bd61de6217556c3923e645043254b782e400b978

  • SHA256

    8fbb33ae75d79566d8a3682d500be2668376e1a79b193ca0d1d6a280822cb0f6

  • SHA512

    8bb865e0b12e999b61947a691fb6959f966518d9e2c46c2d2abd69375e5ac1fc38906c550952c4b5dd9ee1e21c5bbe164e5028a4247902801a0edfcd8e31dd3a

Score
10/10

Malware Config

Signatures

  • BazarBackdoor 4 IoCs

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

  • Blacklisted process makes network request 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 851 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1 (2).exe
    "C:\Users\Admin\AppData\Local\Temp\1 (2).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3148
    • C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe
      2⤵
      • Blacklisted process makes network request
      PID:3664
  • C:\Users\Admin\AppData\Local\Temp\1 (2).exe
    C:\Users\Admin\AppData\Local\Temp\1 (2).exe 3064438252
    1⤵
      PID:2152

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3148-0-0x00000000001D0000-0x00000000001FF000-memory.dmp

            Filesize

            188KB

          • memory/3148-1-0x0000000140000000-0x000000014002D000-memory.dmp

            Filesize

            180KB

          • memory/3664-4-0x00007FF6B80F0000-0x00007FF6B8134000-memory.dmp

            Filesize

            272KB

          • memory/3664-6-0x00007FF6B80F0000-0x00007FF6B8134000-memory.dmp

            Filesize

            272KB