bazarloader | da64fd26d75960fad54e08303b805dfe4e050c5faea0737ed56cfc6d05af6b88

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7v20201028
submitted
23/03/2021, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.FileRepMalware.16835.1352.exe
Size 888KB
Sample210323-ddvtzely6a
SHA256 da64fd26d75960fad54e08303b805dfe4e050c5faea0737ed56cfc6d05af6b88
MD5 4cf6fb8514073319e7759b4f66d13f08
SHA1 7d2d650cf4dfdea99097a923adf3080e832b9fda
SHA512 ff248f57bd0534605e715be3b5f01e38326f3c0214e8e69dc5d2a6be184064b391c0408f003996fe38b3ce0e06b8eb55a1bb13d3351e3bf7d01f38c89e509dba
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader persistence

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 3 IoCs

resource	yara_rule
behavioral1/memory/1676-2-0x0000000000230000-0x000000000025F000-memory.dmp	BazarLoaderVar1
behavioral1/memory/1676-3-0x0000000180000000-0x000000018002D000-memory.dmp	BazarLoaderVar1
behavioral1/memory/1676-4-0x0000000000200000-0x000000000022C000-memory.dmp	BazarLoaderVar1

Executes dropped EXE 2 IoCs

pid	Process
936	TSD242.exe
1660	TSD242.exe

Loads dropped DLL 4 IoCs

pid	Process
1156	cmd.exe
1156	cmd.exe
564	cmd.exe
564	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\M6ZZR1BFFQ = "cmd.exe /c reg.exe add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v MUCLW1SOI /t REG_SZ /d \"\\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TSD242.exe\\\" M3OS\" & start \"H\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\TSD242.exe\" M3OS"	TSD242.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1648	PING.EXE
1620	PING.EXE
1740	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1676	SecuriteInfo.com.FileRepMalware.16835.1352.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1676	SecuriteInfo.com.FileRepMalware.16835.1352.exe
1096	SecuriteInfo.com.FileRepMalware.16835.1352.exe
936	TSD242.exe
1660	TSD242.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1592	1676	SecuriteInfo.com.FileRepMalware.16835.1352.exe	29
PID 1676 wrote to memory of 1592	1676	SecuriteInfo.com.FileRepMalware.16835.1352.exe	29
PID 1676 wrote to memory of 1592	1676	SecuriteInfo.com.FileRepMalware.16835.1352.exe	29
PID 1592 wrote to memory of 1648	1592	cmd.exe	31
PID 1592 wrote to memory of 1648	1592	cmd.exe	31
PID 1592 wrote to memory of 1648	1592	cmd.exe	31
PID 1592 wrote to memory of 1096	1592	cmd.exe	32
PID 1592 wrote to memory of 1096	1592	cmd.exe	32
PID 1592 wrote to memory of 1096	1592	cmd.exe	32
PID 1096 wrote to memory of 1156	1096	SecuriteInfo.com.FileRepMalware.16835.1352.exe	33
PID 1096 wrote to memory of 1156	1096	SecuriteInfo.com.FileRepMalware.16835.1352.exe	33
PID 1096 wrote to memory of 1156	1096	SecuriteInfo.com.FileRepMalware.16835.1352.exe	33
PID 1156 wrote to memory of 1620	1156	cmd.exe	35
PID 1156 wrote to memory of 1620	1156	cmd.exe	35
PID 1156 wrote to memory of 1620	1156	cmd.exe	35
PID 1156 wrote to memory of 936	1156	cmd.exe	36
PID 1156 wrote to memory of 936	1156	cmd.exe	36
PID 1156 wrote to memory of 936	1156	cmd.exe	36
PID 936 wrote to memory of 564	936	TSD242.exe	37
PID 936 wrote to memory of 564	936	TSD242.exe	37
PID 936 wrote to memory of 564	936	TSD242.exe	37
PID 564 wrote to memory of 1740	564	cmd.exe	39
PID 564 wrote to memory of 1740	564	cmd.exe	39
PID 564 wrote to memory of 1740	564	cmd.exe	39
PID 564 wrote to memory of 1660	564	cmd.exe	40
PID 564 wrote to memory of 1660	564	cmd.exe	40
PID 564 wrote to memory of 1660	564	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.16835.1352.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.16835.1352.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\cmd.exe
  cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\securiteInfo.com.FileRepMalware.16835.1352.exe K4CWXJ
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\system32\PING.EXE
    ping 8.8.8.8 -n 2
    3⤵
    - Runs ping.exe
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.16835.1352.exe
    C:\Users\Admin\AppData\Local\Temp\securiteInfo.com.FileRepMalware.16835.1352.exe K4CWXJ
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Windows\system32\cmd.exe
      cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\TSD242.exe TQ75M5A
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1156
    - - C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        5⤵
        Runs ping.exe
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\TSD242.exe
        
        C:\Users\Admin\AppData\Local\Temp\TSD242.exe TQ75M5A
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:936
      - C:\Windows\system32\cmd.exe
        
        cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\tSD242.exe M3OS
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        7⤵
        Runs ping.exe
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\TSD242.exe
        
        C:\Users\Admin\AppData\Local\Temp\tSD242.exe M3OS
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-2-0x0000000000230000-0x000000000025F000-memory.dmp

Download

memory/1676-4-0x0000000000200000-0x000000000022C000-memory.dmp

Download

memory/1676-3-0x0000000180000000-0x000000018002D000-memory.dmp

Download