bazarloader | 8a0fbcde56a9a817c10b0fe5ae281f75385c2a28ca271d736484e689c104e96c

General

Target
b30637b5f760980abc68ab60d7ac92e4.exe
Size 449KB
Sample210126-e8e87apba2
SHA256 8a0fbcde56a9a817c10b0fe5ae281f75385c2a28ca271d736484e689c104e96c
MD5 b30637b5f760980abc68ab60d7ac92e4
SHA1 b48fd6dacb86282c2ee0e8f9a8f28ab9829834c7
SHA512 89f129e1a5f35cbeb6b65f6181b0ac8e94743d1060869f01938d977247345974117d0ac1ad591cb478ed76ee3d17e87ec7bfa242bbc66c8d22fed0edfb8042c0
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader persistence

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a2df-8.dat	BazarLoaderVar1
behavioral2/files/0x000300000001a2df-9.dat	BazarLoaderVar1
behavioral2/files/0x000300000001a2df-13.dat	BazarLoaderVar1
behavioral2/memory/1760-14-0x00007FF779340000-0x00007FF779362000-memory.dmp	BazarLoaderVar1
behavioral2/memory/1760-15-0x00007FF7793421F0-mapping.dmp	BazarLoaderVar1

Executes dropped EXE 2 IoCs

pid	Process
1172	NWM56DB.exe
1612	NWM56DB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\H297YWCSHWI = "cmd.exe /c reg.exe add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v VB8429JF /t REG_SZ /d \"\\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NWM56DB.exe\\\" DBJ75\" & start \"H\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\NWM56DB.exe\" DBJ75"	NWM56DB.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	NWM56DB.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 1760	1612	NWM56DB.exe	90

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3284	PING.EXE
1056	PING.EXE
1432	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4808	b30637b5f760980abc68ab60d7ac92e4.exe
4808	b30637b5f760980abc68ab60d7ac92e4.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4280	4808	b30637b5f760980abc68ab60d7ac92e4.exe	78
PID 4808 wrote to memory of 4280	4808	b30637b5f760980abc68ab60d7ac92e4.exe	78
PID 4280 wrote to memory of 3284	4280	cmd.exe	80
PID 4280 wrote to memory of 3284	4280	cmd.exe	80
PID 4280 wrote to memory of 580	4280	cmd.exe	81
PID 4280 wrote to memory of 580	4280	cmd.exe	81
PID 580 wrote to memory of 896	580	b30637b5f760980abc68ab60d7ac92e4.exe	82
PID 580 wrote to memory of 896	580	b30637b5f760980abc68ab60d7ac92e4.exe	82
PID 896 wrote to memory of 1056	896	cmd.exe	84
PID 896 wrote to memory of 1056	896	cmd.exe	84
PID 896 wrote to memory of 1172	896	cmd.exe	85
PID 896 wrote to memory of 1172	896	cmd.exe	85
PID 1172 wrote to memory of 1300	1172	NWM56DB.exe	86
PID 1172 wrote to memory of 1300	1172	NWM56DB.exe	86
PID 1300 wrote to memory of 1432	1300	cmd.exe	88
PID 1300 wrote to memory of 1432	1300	cmd.exe	88
PID 1300 wrote to memory of 1612	1300	cmd.exe	89
PID 1300 wrote to memory of 1612	1300	cmd.exe	89
PID 1612 wrote to memory of 1760	1612	NWM56DB.exe	90
PID 1612 wrote to memory of 1760	1612	NWM56DB.exe	90
PID 1612 wrote to memory of 1760	1612	NWM56DB.exe	90
PID 1612 wrote to memory of 1760	1612	NWM56DB.exe	90
PID 1612 wrote to memory of 1760	1612	NWM56DB.exe	90
PID 1612 wrote to memory of 1760	1612	NWM56DB.exe	90
PID 1612 wrote to memory of 1760	1612	NWM56DB.exe	90

C:\Users\Admin\AppData\Local\Temp\b30637b5f760980abc68ab60d7ac92e4.exe
"C:\Users\Admin\AppData\Local\Temp\b30637b5f760980abc68ab60d7ac92e4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\b30637b5f760980abc68ab60d7ac92e4.exe SB6USJR
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\system32\PING.EXE
    ping 8.8.8.8 -n 2
    3⤵
    - Runs ping.exe
    PID:3284
- - C:\Users\Admin\AppData\Local\Temp\b30637b5f760980abc68ab60d7ac92e4.exe
    C:\Users\Admin\AppData\Local\Temp\b30637b5f760980abc68ab60d7ac92e4.exe SB6USJR
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:580
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\NWM56DB.exe ZTNXQG
      4⤵
      Suspicious use of WriteProcessMemory
      PID:896
    - - C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        5⤵
        Runs ping.exe
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\NWM56DB.exe
        
        C:\Users\Admin\AppData\Local\Temp\NWM56DB.exe ZTNXQG
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1172
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\NWM56DB.exe DBJ75
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        7⤵
        Runs ping.exe
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\NWM56DB.exe
        
        C:\Users\Admin\AppData\Local\Temp\NWM56DB.exe DBJ75
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe
        8⤵
        
        PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1760-14-0x00007FF779340000-0x00007FF779362000-memory.dmp

Download

Analysis

Sharing