Analysis
-
max time kernel
35s -
max time network
98s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
02-11-2020 22:21
Static task
static1
Behavioral task
behavioral1
Sample
t64.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
t64.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
t64.exe
-
Size
724KB
-
MD5
6d9047478abba33d7fbb15d602859103
-
SHA1
0f97c7af1e4185d2dfa1a9af5ae4c9ad3bfc897a
-
SHA256
6141566287a4de53c826f96492ddf53acd36ff44f90f380011b8ed5f672fef6b
-
SHA512
4ba43b8480acff2709045baa9cc58c5f1123af98b98e391a43e0cd506163765ab25cbebe070ad3aaeee4642be1d1f3881625c0ce8e1440dc99502ce79d2c0ee7
Score
10/10
Malware Config
Signatures
-
BazarBackdoor 5 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
Processes:
description flow ioc HTTP URL 31 https://ikjumnh.xyz/72c5e676b29f5ec54d226eb16133c4da/2 HTTP URL 21 https://citycafeonline.com/72c5e676b29f5ec54d226eb16133c4da/4 HTTP URL 28 https://ikjumnh.xyz/72c5e676b29f5ec54d226eb16133c4da/4 HTTP URL 29 https://ikjumnh.xyz/72c5e676b29f5ec54d226eb16133c4da/4 HTTP URL 30 https://ikjumnh.xyz/72c5e676b29f5ec54d226eb16133c4da/4 -
Blacklisted process makes network request 9 IoCs
Processes:
cmd.exeflow pid process 21 2040 cmd.exe 23 2040 cmd.exe 24 2040 cmd.exe 25 2040 cmd.exe 26 2040 cmd.exe 28 2040 cmd.exe 29 2040 cmd.exe 30 2040 cmd.exe 31 2040 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
t64.exedescription pid process target process PID 1700 set thread context of 2040 1700 t64.exe cmd.exe -
Processes:
t64.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 t64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 t64.exe -
Suspicious use of WriteProcessMemory 852 IoCs
Processes:
t64.exedescription pid process target process PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe PID 1700 wrote to memory of 2040 1700 t64.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\t64.exe"C:\Users\Admin\AppData\Local\Temp\t64.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe2⤵
- Blacklisted process makes network request
-
C:\Users\Admin\AppData\Local\Temp\t64.exeC:\Users\Admin\AppData\Local\Temp\t64.exe 26511689551⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/296-4-0x0000000000490000-0x00000000004BC000-memory.dmpFilesize
176KB
-
memory/608-2-0x000007FEF6200000-0x000007FEF647A000-memory.dmpFilesize
2.5MB
-
memory/1700-1-0x0000000001BC0000-0x0000000001BEC000-memory.dmpFilesize
176KB
-
memory/1700-0-0x0000000001B90000-0x0000000001BBC000-memory.dmpFilesize
176KB
-
memory/2040-5-0x000000004A8E0000-0x000000004A924000-memory.dmpFilesize
272KB
-
memory/2040-6-0x000000004A8FD788-mapping.dmp
-
memory/2040-7-0x000000004A8E0000-0x000000004A924000-memory.dmpFilesize
272KB