bazarbackdoor | bcea99b1ec6fa52fec60589878c451266f260a8b4e2d8c85d700b3d24e0dce4b

Target
PreviewDoc.exe
Size 506KB
Sample201210-kdnjenxb5s
SHA256 bcea99b1ec6fa52fec60589878c451266f260a8b4e2d8c85d700b3d24e0dce4b
MD5 4e0da1ea4579f0bed86d480ab65a2010
SHA1 2224403a67ef396718f3087c47521c8075d0f687
SHA512 f8aa78fecbf11a8c9379bd12a3972b466cdcf73d25623a0f5c87b3e8fd1215be51c2d369da8c010bdf428d9f472f390655f2030a285a1c2967327917503a8264
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 848 created 1248	848	chrome.exe	11

Bazar/Team9 Backdoor payload 3 IoCs

resource	yara_rule
behavioral2/memory/632-9-0x0000000140000000-0x0000000140083000-memory.dmp	BazarBackdoorVar3
behavioral2/memory/632-10-0x0000000140064CD8-mapping.dmp	BazarBackdoorVar3
behavioral2/memory/632-11-0x0000000140000000-0x0000000140083000-memory.dmp	BazarBackdoorVar3

Bazar/Team9 Loader payload 3 IoCs

resource	yara_rule
behavioral2/memory/1684-2-0x0000000002120000-0x0000000002168000-memory.dmp	BazarLoaderVar3
behavioral2/memory/1684-3-0x0000000002170000-0x00000000021B9000-memory.dmp	BazarLoaderVar3
behavioral2/memory/848-8-0x0000000000B00000-0x0000000000B49000-memory.dmp	BazarLoaderVar3

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1684 set thread context of 848	1684	PreviewDoc.exe	29
PID 848 set thread context of 632	848	chrome.exe	31

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
848	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 848	1684	PreviewDoc.exe	29
PID 1684 wrote to memory of 848	1684	PreviewDoc.exe	29
PID 1684 wrote to memory of 848	1684	PreviewDoc.exe	29
PID 1684 wrote to memory of 848	1684	PreviewDoc.exe	29
PID 1684 wrote to memory of 848	1684	PreviewDoc.exe	29
PID 1684 wrote to memory of 848	1684	PreviewDoc.exe	29
PID 1684 wrote to memory of 848	1684	PreviewDoc.exe	29
PID 1684 wrote to memory of 848	1684	PreviewDoc.exe	29
PID 1684 wrote to memory of 848	1684	PreviewDoc.exe	29
PID 1684 wrote to memory of 848	1684	PreviewDoc.exe	29
PID 1684 wrote to memory of 848	1684	PreviewDoc.exe	29
PID 848 wrote to memory of 632	848	chrome.exe	31
PID 848 wrote to memory of 632	848	chrome.exe	31
PID 848 wrote to memory of 632	848	chrome.exe	31
PID 848 wrote to memory of 632	848	chrome.exe	31
PID 848 wrote to memory of 632	848	chrome.exe	31
PID 848 wrote to memory of 632	848	chrome.exe	31
PID 848 wrote to memory of 632	848	chrome.exe	31
PID 848 wrote to memory of 632	848	chrome.exe	31
PID 848 wrote to memory of 632	848	chrome.exe	31
PID 848 wrote to memory of 632	848	chrome.exe	31
PID 848 wrote to memory of 632	848	chrome.exe	31

memory/632-9-0x0000000140000000-0x0000000140083000-memory.dmp

Download

memory/632-11-0x0000000140000000-0x0000000140083000-memory.dmp

Download

memory/848-4-0x0000000140000000-0x0000000140083000-memory.dmp

Download

memory/848-6-0x0000000140000000-0x0000000140083000-memory.dmp

Download

memory/848-8-0x0000000000B00000-0x0000000000B49000-memory.dmp

Download

memory/1684-2-0x0000000002120000-0x0000000002168000-memory.dmp

Download

memory/1684-3-0x0000000002170000-0x00000000021B9000-memory.dmp

Download