bazarloader | d03fffa84d08f296d65b66d549b446a7b9ee228815dcb2d9e6a83f41c6c81e13

General

Target
0389e202b246501b03e119b66e592d1a.exe
Size 1.0MB
Sample210204-vs78y75laa
SHA256 d03fffa84d08f296d65b66d549b446a7b9ee228815dcb2d9e6a83f41c6c81e13
MD5 0389e202b246501b03e119b66e592d1a
SHA1 897b9cb7b27327766c1f4b74ebd5f2c956369652
SHA512 74cea17061600fab33e2f4e60548e71ac8b9c490dd0492ecdf251339dfa9fb80936895f392b98e44199d9e876387b17c35fcc27d8941441b33427b36b307da65
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader persistence

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 3 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a0e3-8.dat	BazarLoaderVar1
behavioral2/files/0x000300000001a0e3-9.dat	BazarLoaderVar1
behavioral2/files/0x000300000001a0e3-13.dat	BazarLoaderVar1

Executes dropped EXE 2 IoCs

pid	Process
2272	HZT5AD3.exe
2140	HZT5AD3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	HZT5AD3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DJ1VK96RQ = "cmd.exe /c reg.exe add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v XXGBWZFSP7 /t REG_SZ /d \"\\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\HZT5AD3.exe\\\" PZTN23Z\" & start \"H\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\HZT5AD3.exe\" PZTN23Z"	HZT5AD3.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
184	PING.EXE
2764	PING.EXE
3732	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
504	0389e202b246501b03e119b66e592d1a.exe
504	0389e202b246501b03e119b66e592d1a.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 504 wrote to memory of 3660	504	0389e202b246501b03e119b66e592d1a.exe	78
PID 504 wrote to memory of 3660	504	0389e202b246501b03e119b66e592d1a.exe	78
PID 3660 wrote to memory of 184	3660	cmd.exe	80
PID 3660 wrote to memory of 184	3660	cmd.exe	80
PID 3660 wrote to memory of 3244	3660	cmd.exe	81
PID 3660 wrote to memory of 3244	3660	cmd.exe	81
PID 3244 wrote to memory of 940	3244	0389e202b246501b03e119b66e592d1a.exe	82
PID 3244 wrote to memory of 940	3244	0389e202b246501b03e119b66e592d1a.exe	82
PID 940 wrote to memory of 2764	940	cmd.exe	84
PID 940 wrote to memory of 2764	940	cmd.exe	84
PID 940 wrote to memory of 2272	940	cmd.exe	85
PID 940 wrote to memory of 2272	940	cmd.exe	85
PID 2272 wrote to memory of 1536	2272	HZT5AD3.exe	86
PID 2272 wrote to memory of 1536	2272	HZT5AD3.exe	86
PID 1536 wrote to memory of 3732	1536	cmd.exe	88
PID 1536 wrote to memory of 3732	1536	cmd.exe	88
PID 1536 wrote to memory of 2140	1536	cmd.exe	89
PID 1536 wrote to memory of 2140	1536	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\0389e202b246501b03e119b66e592d1a.exe
"C:\Users\Admin\AppData\Local\Temp\0389e202b246501b03e119b66e592d1a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:504
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\0389e202b246501b03e119b66e592d1a.exe JJFTT
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\system32\PING.EXE
    ping 8.8.8.8 -n 2
    3⤵
    - Runs ping.exe
    PID:184
- - C:\Users\Admin\AppData\Local\Temp\0389e202b246501b03e119b66e592d1a.exe
    C:\Users\Admin\AppData\Local\Temp\0389e202b246501b03e119b66e592d1a.exe JJFTT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\HZT5AD3.exe VOU5
      4⤵
      Suspicious use of WriteProcessMemory
      PID:940
    - - C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        5⤵
        Runs ping.exe
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\HZT5AD3.exe
        
        C:\Users\Admin\AppData\Local\Temp\HZT5AD3.exe VOU5
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2272
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\HZT5AD3.exe PZTN23Z
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        7⤵
        Runs ping.exe
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\HZT5AD3.exe
        
        C:\Users\Admin\AppData\Local\Temp\HZT5AD3.exe PZTN23Z
        7⤵
        Executes dropped EXE
        
        PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads