bazarloader | da64fd26d75960fad54e08303b805dfe4e050c5faea0737ed56cfc6d05af6b88

General

Target
SecuriteInfo.com.FileRepMalware.16835.1352.exe
Size 888KB
Sample210323-ddvtzely6a
SHA256 da64fd26d75960fad54e08303b805dfe4e050c5faea0737ed56cfc6d05af6b88
MD5 4cf6fb8514073319e7759b4f66d13f08
SHA1 7d2d650cf4dfdea99097a923adf3080e832b9fda
SHA512 ff248f57bd0534605e715be3b5f01e38326f3c0214e8e69dc5d2a6be184064b391c0408f003996fe38b3ce0e06b8eb55a1bb13d3351e3bf7d01f38c89e509dba
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader persistence

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2036 created 2580	2036	P726E7A.exe	21

Bazar/Team9 Loader payload 3 IoCs

resource	yara_rule
behavioral2/memory/648-2-0x0000000002180000-0x00000000021AF000-memory.dmp	BazarLoaderVar1
behavioral2/memory/648-3-0x0000000180000000-0x000000018002D000-memory.dmp	BazarLoaderVar1
behavioral2/memory/648-4-0x00000000001D0000-0x00000000001FC000-memory.dmp	BazarLoaderVar1

Executes dropped EXE 2 IoCs

pid	Process
3028	P726E7A.exe
2036	P726E7A.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	P726E7A.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\NYN5BCCBN6G = "cmd.exe /c reg.exe add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v RRQ5OHCW /t REG_SZ /d \"\\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\P726E7A.exe\\\" HF75M\" & start \"H\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\P726E7A.exe\" HF75M"	P726E7A.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 764	2036	P726E7A.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
2312	PING.EXE
3672	PING.EXE
3856	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
648	SecuriteInfo.com.FileRepMalware.16835.1352.exe
648	SecuriteInfo.com.FileRepMalware.16835.1352.exe
2036	P726E7A.exe
2036	P726E7A.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
648	SecuriteInfo.com.FileRepMalware.16835.1352.exe
4076	SecuriteInfo.com.FileRepMalware.16835.1352.exe
3028	P726E7A.exe
2036	P726E7A.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 3584	648	SecuriteInfo.com.FileRepMalware.16835.1352.exe	78
PID 648 wrote to memory of 3584	648	SecuriteInfo.com.FileRepMalware.16835.1352.exe	78
PID 3584 wrote to memory of 2312	3584	cmd.exe	80
PID 3584 wrote to memory of 2312	3584	cmd.exe	80
PID 3584 wrote to memory of 4076	3584	cmd.exe	81
PID 3584 wrote to memory of 4076	3584	cmd.exe	81
PID 4076 wrote to memory of 3444	4076	SecuriteInfo.com.FileRepMalware.16835.1352.exe	82
PID 4076 wrote to memory of 3444	4076	SecuriteInfo.com.FileRepMalware.16835.1352.exe	82
PID 3444 wrote to memory of 3672	3444	cmd.exe	84
PID 3444 wrote to memory of 3672	3444	cmd.exe	84
PID 3444 wrote to memory of 3028	3444	cmd.exe	85
PID 3444 wrote to memory of 3028	3444	cmd.exe	85
PID 3028 wrote to memory of 1836	3028	P726E7A.exe	86
PID 3028 wrote to memory of 1836	3028	P726E7A.exe	86
PID 1836 wrote to memory of 3856	1836	cmd.exe	88
PID 1836 wrote to memory of 3856	1836	cmd.exe	88
PID 1836 wrote to memory of 2036	1836	cmd.exe	89
PID 1836 wrote to memory of 2036	1836	cmd.exe	89
PID 2036 wrote to memory of 764	2036	P726E7A.exe	90
PID 2036 wrote to memory of 764	2036	P726E7A.exe	90
PID 2036 wrote to memory of 764	2036	P726E7A.exe	90
PID 2036 wrote to memory of 764	2036	P726E7A.exe	90
PID 2036 wrote to memory of 764	2036	P726E7A.exe	90
PID 2036 wrote to memory of 764	2036	P726E7A.exe	90
PID 2036 wrote to memory of 764	2036	P726E7A.exe	90

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2580
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.16835.1352.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.16835.1352.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\securiteInfo.com.FileRepMalware.16835.1352.exe DWVS2WX
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\Windows\system32\PING.EXE
      ping 8.8.8.8 -n 2
      4⤵
      Runs ping.exe
      PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.16835.1352.exe
      C:\Users\Admin\AppData\Local\Temp\securiteInfo.com.FileRepMalware.16835.1352.exe DWVS2WX
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4076
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\P726E7A.exe L45Q2T
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3444
      - C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        6⤵
        Runs ping.exe
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\P726E7A.exe
        
        C:\Users\Admin\AppData\Local\Temp\P726E7A.exe L45Q2T
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\p726E7A.exe HF75M
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\system32\PING.EXE
        
        ping 8.8.8.8 -n 2
        8⤵
        Runs ping.exe
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\P726E7A.exe
        
        C:\Users\Admin\AppData\Local\Temp\p726E7A.exe HF75M
        8⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-3-0x0000000180000000-0x000000018002D000-memory.dmp

Download

memory/648-4-0x00000000001D0000-0x00000000001FC000-memory.dmp

Download

memory/648-2-0x0000000002180000-0x00000000021AF000-memory.dmp

Download

memory/764-29-0x00007FF6F6360000-0x00007FF6F6385000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads