bazarbackdoor | 5e01783bf469b84035524d05fa1cc5ae4128a4c84f2062b8d50f85a56f1f1ec0

General

Target

38.exe
Size

724KB
MD5

67295decb6b52cd6e304e29d7009aa6e
SHA1

f0d525f021516659a4bf4c78122e5ba4189844f5
SHA256

5e01783bf469b84035524d05fa1cc5ae4128a4c84f2062b8d50f85a56f1f1ec0
SHA512

0e8bdae16494de1c58942c49a2d82cf7c25a167ac73a5c7df8ba59d03e0dde109c9fd8b6dcd2e909001b1e8b49cc2cebf5efae53976c3f13ce38061aca0559ac

Score

10^/10

bazarbackdoor backdoor

Malware Config

Signatures

BazarBackdoor 6 IoCs

Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

backdoor bazarbackdoor

Processes:

description	flow	ioc
HTTP URL	34	https://citycafeonline.com/da05787325f3822fd6286484e0b8ce1d/4
HTTP URL	36	https://woodallmcneill.com/da05787325f3822fd6286484e0b8ce1d/4
HTTP URL	38	https://ikjumnh.xyz/da05787325f3822fd6286484e0b8ce1d/4
HTTP URL	39	https://ikjumnh.xyz/da05787325f3822fd6286484e0b8ce1d/4
HTTP URL	40	https://ikjumnh.xyz/da05787325f3822fd6286484e0b8ce1d/4
HTTP URL	41	https://ikjumnh.xyz/da05787325f3822fd6286484e0b8ce1d/2

Blacklisted process makes network request 6 IoCs

Processes:

cmd.exe

flow pid process

34 2736 cmd.exe
36 2736 cmd.exe
38 2736 cmd.exe
39 2736 cmd.exe
40 2736 cmd.exe
41 2736 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

38.exe

description pid process target process

PID 744 set thread context of 2736 744 38.exe cmd.exe

flow	pid	process
34	2736	cmd.exe
36	2736	cmd.exe
38	2736	cmd.exe
39	2736	cmd.exe
40	2736	cmd.exe
41	2736	cmd.exe

description	pid	process	target process
PID 744 set thread context of 2736	744	38.exe	cmd.exe

Suspicious use of WriteProcessMemory 851 IoCs

Processes:

38.exe

description	pid	process	target process
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe
PID 744 wrote to memory of 2736	744	38.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\38.exe
"C:\Users\Admin\AppData\Local\Temp\38.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe
2⤵
- Blacklisted process makes network request
PID:2736

C:\Users\Admin\AppData\Local\Temp\38.exe
C:\Users\Admin\AppData\Local\Temp\38.exe 629269658
1⤵
PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-0-0x0000000000500000-0x000000000052C000-memory.dmp

Filesize
176KB

Download
memory/744-1-0x0000000000530000-0x000000000055C000-memory.dmp

Filesize
176KB

Download
memory/2392-3-0x0000000002000000-0x000000000202C000-memory.dmp

Filesize
176KB

Download
memory/2736-4-0x00007FF6049A0000-0x00007FF6049E4000-memory.dmp

Filesize
272KB

Download
memory/2736-5-0x00007FF6049BD788-mapping.dmp

Download
memory/2736-6-0x00007FF6049A0000-0x00007FF6049E4000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing