bazarloader | a5428bdcca0e7eb55e61c50fca985553e0c993dfdd65052ec2e528d5d7d4adf3

General

Target
7a51f04e7e665807091656db38ebc814.exe
Size 1.0MB
Sample210204-2df1k712en
SHA256 a5428bdcca0e7eb55e61c50fca985553e0c993dfdd65052ec2e528d5d7d4adf3
MD5 7a51f04e7e665807091656db38ebc814
SHA1 81dc9fa854987fae1d66dd0a4caa91948cdd6fb7
SHA512 e3bd1725888c87767caccf9802ce7be132d0608fb9449f5605f25b64ca9874c39e090ea62df31417ad4b96d15a312226fd6ca2ae2cce3a67459f27ec8294bfce
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader persistence

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 3 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-8.dat	BazarLoaderVar1
behavioral2/files/0x000300000001a0e3-9.dat	BazarLoaderVar1
behavioral2/files/0x000300000001a0e3-13.dat	BazarLoaderVar1

Executes dropped EXE 2 IoCs

pid	Process
1632	HZT759E.exe
3928	HZT759E.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	HZT759E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DJ1VK96RQ = "cmd.exe /c reg.exe add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v XXGBWZFSP7 /t REG_SZ /d \"\\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\HZT759E.exe\\\" PZTN23Z\" & start \"H\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\HZT759E.exe\" PZTN23Z"	HZT759E.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
2352	PING.EXE
2900	PING.EXE
3384	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
828	7a51f04e7e665807091656db38ebc814.exe
828	7a51f04e7e665807091656db38ebc814.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 212	828	7a51f04e7e665807091656db38ebc814.exe	78
PID 828 wrote to memory of 212	828	7a51f04e7e665807091656db38ebc814.exe	78
PID 212 wrote to memory of 2352	212	cmd.exe	80
PID 212 wrote to memory of 2352	212	cmd.exe	80
PID 212 wrote to memory of 3064	212	cmd.exe	81
PID 212 wrote to memory of 3064	212	cmd.exe	81
PID 3064 wrote to memory of 396	3064	7a51f04e7e665807091656db38ebc814.exe	82
PID 3064 wrote to memory of 396	3064	7a51f04e7e665807091656db38ebc814.exe	82
PID 396 wrote to memory of 2900	396	cmd.exe	84
PID 396 wrote to memory of 2900	396	cmd.exe	84
PID 396 wrote to memory of 1632	396	cmd.exe	85
PID 396 wrote to memory of 1632	396	cmd.exe	85
PID 1632 wrote to memory of 3632	1632	HZT759E.exe	86
PID 1632 wrote to memory of 3632	1632	HZT759E.exe	86
PID 3632 wrote to memory of 3384	3632	cmd.exe	88
PID 3632 wrote to memory of 3384	3632	cmd.exe	88
PID 3632 wrote to memory of 3928	3632	cmd.exe	89
PID 3632 wrote to memory of 3928	3632	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\7a51f04e7e665807091656db38ebc814.exe
"C:\Users\Admin\AppData\Local\Temp\7a51f04e7e665807091656db38ebc814.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\7a51f04e7e665807091656db38ebc814.exe JJFTT
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\system32\PING.EXE
    ping 8.8.8.8 -n 2
    3⤵
    - Runs ping.exe
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\7a51f04e7e665807091656db38ebc814.exe
    C:\Users\Admin\AppData\Local\Temp\7a51f04e7e665807091656db38ebc814.exe JJFTT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\HZT759E.exe VOU5
      4⤵
      Suspicious use of WriteProcessMemory
      PID:396
    - - C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        5⤵
        Runs ping.exe
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\HZT759E.exe
        
        C:\Users\Admin\AppData\Local\Temp\HZT759E.exe VOU5
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1632
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\HZT759E.exe PZTN23Z
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        7⤵
        Runs ping.exe
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\HZT759E.exe
        
        C:\Users\Admin\AppData\Local\Temp\HZT759E.exe PZTN23Z
        7⤵
        Executes dropped EXE
        
        PID:3928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads