Analysis
- max time kernel
147s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
31/03/2021, 19:27
Static task
static1
Behavioral task
behavioral1
Sample
subscription_1617218228.xlsb
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
subscription_1617218228.xlsb
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target subscription_1617218228.xlsb
- Size 240KB
- Sample210331-ffm2r1grg6
- SHA256 8c39b5dd896e4b7163f0c9f27b3ecde4435fa98666cd6e8e1f0a7df73ed757f7
- MD5 cc029b8675d3b262564d4d81c6008d5b
- SHA1 8ff96b31ed0dc8689d868dcabc610aa3efbbe13c
- SHA512 ab67497eb40b043ad18e6346eedbb906ce9411b660ae4ccb0b7939b891625fa324a0f505737251748ccc0874b85e0a6f453920d01d890e2e48f617821432ae61
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3776 3116 cmd.exe 67 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2784 3116 rundll32.exe 67 - Bazar/Team9 Loader payload 2 IoCs
resource yara_rule behavioral2/memory/1792-19-0x00000268FAAE0000-0x00000268FAB14000-memory.dmp BazarLoaderVar6 behavioral2/memory/2888-29-0x0000029255AD0000-0x0000029255B04000-memory.dmp BazarLoaderVar6 - Nloader Payload 1 IoCs
resource yara_rule behavioral2/memory/3712-14-0x00000000004E0000-0x00000000004E5000-memory.dmp nloader - Blocklisted process makes network request 2 IoCs
flow pid Process 32 3712 rundll32.exe 33 3712 rundll32.exe - Executes dropped EXE 2 IoCs
pid Process 1792 fjlq.exe 2888 fjlq.exe - Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
flow ioc 129 ekasekyw.bazar 204 yggyavre.bazar 348 ygxiekom.bazar 288 ersiekyw.bazar 258 ywkyekvi.bazar 260 meixygvi.bazar 289 omsiekvi.bazar 290 omoxekre.bazar 309 requekvi.bazar 57 mexoekvi.bazar 132 soohygom.bazar 188 yzdiavom.bazar 212 ywanwyvi.bazar 277 ywxiavom.bazar 305 reanavyw.bazar 316 yzdiwyyw.bazar 338 onwoygyw.bazar 64 ekdiwyom.bazar 97 meoxavre.bazar 179 evsiekre.bazar 98 meleavre.bazar 232 regywyyw.bazar 306 udapwyyw.bazar 103 ekixavvi.bazar 164 omapwyre.bazar 333 vikyavre.bazar 238 soohygvi.bazar 244 ewquwyre.bazar 249 vixoygyw.bazar 144 evleekom.bazar 186 vikyekyw.bazar 213 yrgyygom.bazar 272 reezavre.bazar 121 wauxwyre.bazar 137 soraygyw.bazar 184 ywoxekre.bazar 203 eranekom.bazar 257 evwoygyw.bazar 293 waanavom.bazar 301 yrgyekre.bazar 324 ygezekom.bazar 118 ewqaekre.bazar 195 ygdiekom.bazar 200 wyxowyre.bazar 156 avwoygre.bazar 209 ygixygom.bazar 250 yroxygvi.bazar 274 viaswyvi.bazar 337 waoxygyw.bazar 345 wykyavom.bazar 125 yrapygvi.bazar 176 omxoekom.bazar 211 avquavom.bazar 357 ekraavvi.bazar 113 wywoekvi.bazar 120 avoxwyyw.bazar 167 udxiwyom.bazar 145 udezekvi.bazar 251 yrxowyyw.bazar 256 yrquekre.bazar 63 avrawyom.bazar 91 udixygom.bazar 92 ekapwyyw.bazar 190 ewdiekvi.bazar - Loads dropped DLL 1 IoCs
pid Process 3712 rundll32.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3116 EXCEL.EXE - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3116 wrote to memory of 3776 3116 EXCEL.EXE 78 PID 3116 wrote to memory of 3776 3116 EXCEL.EXE 78 PID 3776 wrote to memory of 3952 3776 cmd.exe 80 PID 3776 wrote to memory of 3952 3776 cmd.exe 80 PID 3116 wrote to memory of 2784 3116 EXCEL.EXE 83 PID 3116 wrote to memory of 2784 3116 EXCEL.EXE 83 PID 2784 wrote to memory of 3712 2784 rundll32.exe 84 PID 2784 wrote to memory of 3712 2784 rundll32.exe 84 PID 2784 wrote to memory of 3712 2784 rundll32.exe 84 PID 3712 wrote to memory of 1792 3712 rundll32.exe 86 PID 3712 wrote to memory of 1792 3712 rundll32.exe 86
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\subscription_1617218228.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c certutil -decode %PUBLIC%\18482.bki %PUBLIC%\18482.xoq2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\system32\certutil.execertutil -decode C:\Users\Public\18482.bki C:\Users\Public\18482.xoq3⤵PID:3952
-
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32 C:\Users\Public\18482.xoq,DF12⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\rundll32.exerundll32 C:\Users\Public\18482.xoq,DF13⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\ProgramData\fjlq\fjlq.exe"C:\ProgramData\fjlq\fjlq.exe"4⤵
- Executes dropped EXE
PID:1792
-
-
-
-
C:\ProgramData\fjlq\fjlq.exeC:\ProgramData\fjlq\fjlq.exe 13746274301⤵
- Executes dropped EXE
PID:2888