bazarloader | 8a0fbcde56a9a817c10b0fe5ae281f75385c2a28ca271d736484e689c104e96c

Analysis

max time kernel
113s
max time network
111s
platform
windows7_x64
resource
win7v20201028
submitted
26/01/2021, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b30637b5f760980abc68ab60d7ac92e4.exe
Size 449KB
Sample210126-e8e87apba2
SHA256 8a0fbcde56a9a817c10b0fe5ae281f75385c2a28ca271d736484e689c104e96c
MD5 b30637b5f760980abc68ab60d7ac92e4
SHA1 b48fd6dacb86282c2ee0e8f9a8f28ab9829834c7
SHA512 89f129e1a5f35cbeb6b65f6181b0ac8e94743d1060869f01938d977247345974117d0ac1ad591cb478ed76ee3d17e87ec7bfa242bbc66c8d22fed0edfb8042c0
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader persistence

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 9 IoCs

resource	yara_rule
behavioral1/files/0x000d00000000560a-7.dat	BazarLoaderVar1
behavioral1/files/0x000d00000000560a-8.dat	BazarLoaderVar1
behavioral1/files/0x000d00000000560a-9.dat	BazarLoaderVar1
behavioral1/files/0x000d00000000560a-11.dat	BazarLoaderVar1
behavioral1/files/0x000d00000000560a-14.dat	BazarLoaderVar1
behavioral1/files/0x000d00000000560a-15.dat	BazarLoaderVar1
behavioral1/files/0x000d00000000560a-17.dat	BazarLoaderVar1
behavioral1/memory/648-19-0x000000004A4E0000-0x000000004A502000-memory.dmp	BazarLoaderVar1
behavioral1/memory/648-20-0x000000004A4E21F0-mapping.dmp	BazarLoaderVar1

Executes dropped EXE 2 IoCs

pid	Process
532	U3X22AD.exe
920	U3X22AD.exe

Loads dropped DLL 4 IoCs

pid	Process
748	cmd.exe
748	cmd.exe
1004	cmd.exe
1004	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\TB6FSHUO4W = "cmd.exe /c reg.exe add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v K6WK1WN7P /t REG_SZ /d \"\\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\U3X22AD.exe\\\" EZWF\" & start \"H\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\U3X22AD.exe\" EZWF"	U3X22AD.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 920 set thread context of 648	920	U3X22AD.exe	41

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1608	PING.EXE
1000	PING.EXE
808	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1064	b30637b5f760980abc68ab60d7ac92e4.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 844	1064	b30637b5f760980abc68ab60d7ac92e4.exe	29
PID 1064 wrote to memory of 844	1064	b30637b5f760980abc68ab60d7ac92e4.exe	29
PID 1064 wrote to memory of 844	1064	b30637b5f760980abc68ab60d7ac92e4.exe	29
PID 844 wrote to memory of 1608	844	cmd.exe	31
PID 844 wrote to memory of 1608	844	cmd.exe	31
PID 844 wrote to memory of 1608	844	cmd.exe	31
PID 844 wrote to memory of 1496	844	cmd.exe	32
PID 844 wrote to memory of 1496	844	cmd.exe	32
PID 844 wrote to memory of 1496	844	cmd.exe	32
PID 1496 wrote to memory of 748	1496	b30637b5f760980abc68ab60d7ac92e4.exe	33
PID 1496 wrote to memory of 748	1496	b30637b5f760980abc68ab60d7ac92e4.exe	33
PID 1496 wrote to memory of 748	1496	b30637b5f760980abc68ab60d7ac92e4.exe	33
PID 748 wrote to memory of 1000	748	cmd.exe	35
PID 748 wrote to memory of 1000	748	cmd.exe	35
PID 748 wrote to memory of 1000	748	cmd.exe	35
PID 748 wrote to memory of 532	748	cmd.exe	36
PID 748 wrote to memory of 532	748	cmd.exe	36
PID 748 wrote to memory of 532	748	cmd.exe	36
PID 532 wrote to memory of 1004	532	U3X22AD.exe	37
PID 532 wrote to memory of 1004	532	U3X22AD.exe	37
PID 532 wrote to memory of 1004	532	U3X22AD.exe	37
PID 1004 wrote to memory of 808	1004	cmd.exe	39
PID 1004 wrote to memory of 808	1004	cmd.exe	39
PID 1004 wrote to memory of 808	1004	cmd.exe	39
PID 1004 wrote to memory of 920	1004	cmd.exe	40
PID 1004 wrote to memory of 920	1004	cmd.exe	40
PID 1004 wrote to memory of 920	1004	cmd.exe	40
PID 920 wrote to memory of 648	920	U3X22AD.exe	41
PID 920 wrote to memory of 648	920	U3X22AD.exe	41
PID 920 wrote to memory of 648	920	U3X22AD.exe	41
PID 920 wrote to memory of 648	920	U3X22AD.exe	41
PID 920 wrote to memory of 648	920	U3X22AD.exe	41
PID 920 wrote to memory of 648	920	U3X22AD.exe	41
PID 920 wrote to memory of 648	920	U3X22AD.exe	41
PID 920 wrote to memory of 648	920	U3X22AD.exe	41

C:\Users\Admin\AppData\Local\Temp\b30637b5f760980abc68ab60d7ac92e4.exe
"C:\Users\Admin\AppData\Local\Temp\b30637b5f760980abc68ab60d7ac92e4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\system32\cmd.exe
  cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\b30637b5f760980abc68ab60d7ac92e4.exe AFR5JP
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\system32\PING.EXE
    ping 8.8.8.8 -n 2
    3⤵
    - Runs ping.exe
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\b30637b5f760980abc68ab60d7ac92e4.exe
    C:\Users\Admin\AppData\Local\Temp\b30637b5f760980abc68ab60d7ac92e4.exe AFR5JP
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\system32\cmd.exe
      cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\U3X22AD.exe KYNZE0R
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:748
    - - C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        5⤵
        Runs ping.exe
        
        PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\U3X22AD.exe
        
        C:\Users\Admin\AppData\Local\Temp\U3X22AD.exe KYNZE0R
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:532
      - C:\Windows\system32\cmd.exe
        
        cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\U3X22AD.exe EZWF
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        7⤵
        Runs ping.exe
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\U3X22AD.exe
        
        C:\Users\Admin\AppData\Local\Temp\U3X22AD.exe EZWF
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe
        8⤵
        
        PID:648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-19-0x000000004A4E0000-0x000000004A502000-memory.dmp

Download