bazarbackdoor | a63664c9f44f5e5b2e2537c844a0792db3b68fe822c9785075d3e5e76394f5ad

General

Target

a63664c9f44f5e5b2e2537c844a0792db3b68fe822c9785075d3e5e76394f5ad.exe
Size

330KB
MD5

b38a883c02ea265b03166cb902e4db4b
SHA1

d7630b56d299445cf64e810e7c7dbb59a7572145
SHA256

a63664c9f44f5e5b2e2537c844a0792db3b68fe822c9785075d3e5e76394f5ad
SHA512

ac8f49a1592ef2bcc6e2a6093589767607d8bec6f5fbf084f286c814f62c5cfe83e489b3cad780e06c120de3fbacbc8302e63b6571784ab3ecad51f6bf9b65ee

Score

10^/10

bazarbackdoor backdoor

Malware Config

Signatures

BazarBackdoor 1 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Processes:

description flow ioc

HTTP URL 17 https://194.87.145.86/6ea5901ae1272735f9e012d6c17ecc4d/4
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1180 created 492 1180 WerFault.exe a63664c9f44f5e5b2e2537c844a0792db3b68fe822c9785075d3e5e76394f5ad.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description flow ioc

HTTP URL 26 https://api.opennicproject.org/geoip/
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1180 492 WerFault.exe a63664c9f44f5e5b2e2537c844a0792db3b68fe822c9785075d3e5e76394f5ad.exe

description	flow	ioc
HTTP URL	17	https://194.87.145.86/6ea5901ae1272735f9e012d6c17ecc4d/4

description	pid	process	target process
PID 1180 created 492	1180	WerFault.exe	a63664c9f44f5e5b2e2537c844a0792db3b68fe822c9785075d3e5e76394f5ad.exe

description	flow	ioc
HTTP URL	26	https://api.opennicproject.org/geoip/

pid	pid_target	process	target process
1180	492	WerFault.exe	a63664c9f44f5e5b2e2537c844a0792db3b68fe822c9785075d3e5e76394f5ad.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1180 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1180	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a63664c9f44f5e5b2e2537c844a0792db3b68fe822c9785075d3e5e76394f5ad.exe
"C:\Users\Admin\AppData\Local\Temp\a63664c9f44f5e5b2e2537c844a0792db3b68fe822c9785075d3e5e76394f5ad.exe"
1⤵
PID:492

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 492 -s 1824
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-0-0x0000023013BF0000-0x0000023013BF1000-memory.dmp

Filesize
4KB

Download
memory/1180-1-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-2-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-3-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-4-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-5-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-6-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-7-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-8-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-9-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-10-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-11-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-12-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-13-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-14-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-15-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-16-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-17-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-19-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-18-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-20-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-21-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-22-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-23-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-24-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-25-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-26-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-27-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-28-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-29-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-30-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-31-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-32-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-33-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-34-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-35-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-36-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-37-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-38-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-39-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-40-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-41-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-42-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-43-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-44-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-45-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-46-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-47-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-48-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-49-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-50-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-51-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-52-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-53-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-54-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-55-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-56-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-57-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-58-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-59-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-60-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-61-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download
memory/1180-62-0x0000023014580000-0x0000023014581000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads