bazarbackdoor | 09da6102c6b77c609537c5b3d8bf9de8f4143d533856d174929859feda5806fa

Analysis

max time kernel
140s
max time network
141s
platform
windows10_x64
resource
win10v20201028
submitted
10-11-2020 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09da6102c6b77c609537c5b3d8bf9de8f4143d533856d174929859feda5806fa.exe
Size

332KB
MD5

830b5861063e0d5a94b9b895f5b58fe5
SHA1

26b6a975f3af21eb43986e08b5b5472e6dcbf770
SHA256

09da6102c6b77c609537c5b3d8bf9de8f4143d533856d174929859feda5806fa
SHA512

b8a6f4c9d469cc2b903338deb47758acc7fe92aab8fcc096d3e54cf3ab8134caa62dde9a20e88f05a1a0c6f8645f66d2d34dfdd3571551c66e5b7d8aef7893b8

Score

10^/10

bazarbackdoor backdoor

Malware Config

Signatures

BazarBackdoor 1 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Processes:

description flow ioc

HTTP URL 13 https://194.87.145.86/6ea5901ae1272735f9e012d6c17ecc4d/4
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3380 created 3324 3380 WerFault.exe 09da6102c6b77c609537c5b3d8bf9de8f4143d533856d174929859feda5806fa.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description flow ioc

HTTP URL 23 https://api.opennicproject.org/geoip/
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3380 3324 WerFault.exe 09da6102c6b77c609537c5b3d8bf9de8f4143d533856d174929859feda5806fa.exe

description	flow	ioc
HTTP URL	13	https://194.87.145.86/6ea5901ae1272735f9e012d6c17ecc4d/4

description	pid	process	target process
PID 3380 created 3324	3380	WerFault.exe	09da6102c6b77c609537c5b3d8bf9de8f4143d533856d174929859feda5806fa.exe

description	flow	ioc
HTTP URL	23	https://api.opennicproject.org/geoip/

pid	pid_target	process	target process
3380	3324	WerFault.exe	09da6102c6b77c609537c5b3d8bf9de8f4143d533856d174929859feda5806fa.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe
3380	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3380 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	3380	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\09da6102c6b77c609537c5b3d8bf9de8f4143d533856d174929859feda5806fa.exe
"C:\Users\Admin\AppData\Local\Temp\09da6102c6b77c609537c5b3d8bf9de8f4143d533856d174929859feda5806fa.exe"
1⤵
PID:3324

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3324 -s 1768
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3380-0-0x0000014733150000-0x0000014733151000-memory.dmp

Filesize
4KB

Download
memory/3380-2-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-1-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-4-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-3-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-5-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-6-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-7-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-8-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-9-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-10-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-11-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-12-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-14-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-13-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-15-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-16-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-17-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-18-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-19-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-20-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-21-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-22-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-23-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-24-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-25-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-26-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-27-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-28-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-29-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-30-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-31-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-32-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-33-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-34-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-35-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-36-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-37-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-38-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-39-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-40-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-41-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-42-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-43-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-45-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-44-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-46-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-47-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-48-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-49-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-50-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-51-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-52-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-53-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-54-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-55-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-56-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-57-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-58-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-59-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-60-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-61-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-62-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-64-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download
memory/3380-65-0x0000014733A90000-0x0000014733A91000-memory.dmp

Filesize
4KB

Download