bazarbackdoor | b8cd9fdd5bdd9821ef060fe771255060309a821ea2b39de723c907512ef9abad

General

Target

Document-Annual.exe
Size

563KB
MD5

6f7cc36be83724f96cd10e69a7856b41
SHA1

296e9d49e85efa47bc3ed83fee33b193b4a12298
SHA256

b8cd9fdd5bdd9821ef060fe771255060309a821ea2b39de723c907512ef9abad
SHA512

0b90a00ef773abfd8987b6756236192e4db13f6aec540759ceb7b45ed36a2415a4435d5cc7361d1a3bd462d97e6e33774fd5aa788a511cb525cc49820656df7c

Score

10^/10

backdoor bazarbackdoor

Malware Config

Signatures

BazarBackdoor 4 IoCs

Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

backdoor bazarbackdoor

Processes:

description	flow	ioc
HTTP URL	21	https://lmnab.xyz/52bc95c2c7fb237dde9619460259bd9f/4
HTTP URL	22	https://lmnab.xyz/52bc95c2c7fb237dde9619460259bd9f/4
HTTP URL	23	https://lmnab.xyz/52bc95c2c7fb237dde9619460259bd9f/4
HTTP URL	25	https://lmnab.xyz/52bc95c2c7fb237dde9619460259bd9f/2

Blacklisted process makes network request 4 IoCs

Processes:

cmd.exe

flow pid process

21 2404 cmd.exe
22 2404 cmd.exe
23 2404 cmd.exe
25 2404 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Document-Annual.exe

description pid process target process

PID 3980 set thread context of 2404 3980 Document-Annual.exe cmd.exe

flow	pid	process
21	2404	cmd.exe
22	2404	cmd.exe
23	2404	cmd.exe
25	2404	cmd.exe

description	pid	process	target process
PID 3980 set thread context of 2404	3980	Document-Annual.exe	cmd.exe

Suspicious use of WriteProcessMemory 851 IoCs

Processes:

Document-Annual.exe

description	pid	process	target process
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe
PID 3980 wrote to memory of 2404	3980	Document-Annual.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Document-Annual.exe
"C:\Users\Admin\AppData\Local\Temp\Document-Annual.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe
2⤵
- Blacklisted process makes network request
PID:2404

C:\Users\Admin\AppData\Local\Temp\Document-Annual.exe
C:\Users\Admin\AppData\Local\Temp\Document-Annual.exe 3050007418
1⤵
PID:2276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-3-0x0000000001FD0000-0x0000000001FFF000-memory.dmp

Filesize
188KB

Download
memory/2404-5-0x00007FF6ACB8D2D8-mapping.dmp

Download
memory/2404-4-0x00007FF6ACB70000-0x00007FF6ACBB4000-memory.dmp

Filesize
272KB

Download
memory/2404-6-0x00007FF6ACB70000-0x00007FF6ACBB4000-memory.dmp

Filesize
272KB

Download
memory/3980-0-0x0000000001FE0000-0x000000000200F000-memory.dmp

Filesize
188KB

Download
memory/3980-1-0x0000000002010000-0x000000000203F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing