bazarloader | a5428bdcca0e7eb55e61c50fca985553e0c993dfdd65052ec2e528d5d7d4adf3

General

Target
7a51f04e7e665807091656db38ebc814.exe
Size 1.0MB
Sample210204-2df1k712en
SHA256 a5428bdcca0e7eb55e61c50fca985553e0c993dfdd65052ec2e528d5d7d4adf3
MD5 7a51f04e7e665807091656db38ebc814
SHA1 81dc9fa854987fae1d66dd0a4caa91948cdd6fb7
SHA512 e3bd1725888c87767caccf9802ce7be132d0608fb9449f5605f25b64ca9874c39e090ea62df31417ad4b96d15a312226fd6ca2ae2cce3a67459f27ec8294bfce
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader persistence

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 7 IoCs

resource	yara_rule
behavioral1/files/0x000d00000000560a-7.dat	BazarLoaderVar1
behavioral1/files/0x000d00000000560a-9.dat	BazarLoaderVar1
behavioral1/files/0x000d00000000560a-8.dat	BazarLoaderVar1
behavioral1/files/0x000d00000000560a-11.dat	BazarLoaderVar1
behavioral1/files/0x000d00000000560a-14.dat	BazarLoaderVar1
behavioral1/files/0x000d00000000560a-15.dat	BazarLoaderVar1
behavioral1/files/0x000d00000000560a-17.dat	BazarLoaderVar1

Executes dropped EXE 2 IoCs

pid	Process
1512	U3X38AD.exe
548	U3X38AD.exe

Loads dropped DLL 4 IoCs

pid	Process
912	cmd.exe
912	cmd.exe
972	cmd.exe
972	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\TB6B9PY4CC = "cmd.exe /c reg.exe add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v K6WK1WN7P /t REG_SZ /d \"\\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\U3X38AD.exe\\\" GRTV\" & start \"H\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\U3X38AD.exe\" GRTV"	U3X38AD.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1232	PING.EXE
1724	PING.EXE
1448	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
892	7a51f04e7e665807091656db38ebc814.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1252	892	7a51f04e7e665807091656db38ebc814.exe	29
PID 892 wrote to memory of 1252	892	7a51f04e7e665807091656db38ebc814.exe	29
PID 892 wrote to memory of 1252	892	7a51f04e7e665807091656db38ebc814.exe	29
PID 1252 wrote to memory of 1232	1252	cmd.exe	31
PID 1252 wrote to memory of 1232	1252	cmd.exe	31
PID 1252 wrote to memory of 1232	1252	cmd.exe	31
PID 1252 wrote to memory of 1568	1252	cmd.exe	32
PID 1252 wrote to memory of 1568	1252	cmd.exe	32
PID 1252 wrote to memory of 1568	1252	cmd.exe	32
PID 1568 wrote to memory of 912	1568	7a51f04e7e665807091656db38ebc814.exe	33
PID 1568 wrote to memory of 912	1568	7a51f04e7e665807091656db38ebc814.exe	33
PID 1568 wrote to memory of 912	1568	7a51f04e7e665807091656db38ebc814.exe	33
PID 912 wrote to memory of 1724	912	cmd.exe	35
PID 912 wrote to memory of 1724	912	cmd.exe	35
PID 912 wrote to memory of 1724	912	cmd.exe	35
PID 912 wrote to memory of 1512	912	cmd.exe	36
PID 912 wrote to memory of 1512	912	cmd.exe	36
PID 912 wrote to memory of 1512	912	cmd.exe	36
PID 1512 wrote to memory of 972	1512	U3X38AD.exe	37
PID 1512 wrote to memory of 972	1512	U3X38AD.exe	37
PID 1512 wrote to memory of 972	1512	U3X38AD.exe	37
PID 972 wrote to memory of 1448	972	cmd.exe	39
PID 972 wrote to memory of 1448	972	cmd.exe	39
PID 972 wrote to memory of 1448	972	cmd.exe	39
PID 972 wrote to memory of 548	972	cmd.exe	40
PID 972 wrote to memory of 548	972	cmd.exe	40
PID 972 wrote to memory of 548	972	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\7a51f04e7e665807091656db38ebc814.exe
"C:\Users\Admin\AppData\Local\Temp\7a51f04e7e665807091656db38ebc814.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\system32\cmd.exe
  cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\7a51f04e7e665807091656db38ebc814.exe C7NLLX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\system32\PING.EXE
    ping 8.8.8.8 -n 2
    3⤵
    - Runs ping.exe
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\7a51f04e7e665807091656db38ebc814.exe
    C:\Users\Admin\AppData\Local\Temp\7a51f04e7e665807091656db38ebc814.exe C7NLLX
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Windows\system32\cmd.exe
      cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\U3X38AD.exe MQJFGTN
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:912
    - - C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        5⤵
        Runs ping.exe
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\U3X38AD.exe
        
        C:\Users\Admin\AppData\Local\Temp\U3X38AD.exe MQJFGTN
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1512
      - C:\Windows\system32\cmd.exe
        
        cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\U3X38AD.exe GRTV
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        7⤵
        Runs ping.exe
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\U3X38AD.exe
        
        C:\Users\Admin\AppData\Local\Temp\U3X38AD.exe GRTV
        7⤵
        Executes dropped EXE
        
        PID:548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads