Analysis
- max time kernel
52s - max time network
111s - platform
windows7_x64 - resource
win7v20201028 - submitted
31/03/2021, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
46bb7c8edade2a3cafb4e69bf3c64bcd.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
46bb7c8edade2a3cafb4e69bf3c64bcd.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 46bb7c8edade2a3cafb4e69bf3c64bcd.exe
- Size 621KB
- Sample210331-pdvp58l57e
- SHA256 c8510031a868ab8ef2b11a4261d2aba8c9be252294780faea012bfa94c6d0c70
- MD5 46bb7c8edade2a3cafb4e69bf3c64bcd
- SHA1 495bdcb4c36c150f23c7e6156cc1486586e26b17
- SHA512 d40bc1325f87725da3714a59bba6064f0f75acae095a2bc7d03750d9236da4cc98107fcaf62c2e3dc3be8cc11ebb2929597beba261a04e9ccf409bd0547262bd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
- Bazar/Team9 Loader payload 2 IoCs
resource yara_rule behavioral1/memory/1044-2-0x0000000000220000-0x0000000000254000-memory.dmp BazarLoaderVar6 behavioral1/memory/1620-4-0x0000000000230000-0x0000000000264000-memory.dmp BazarLoaderVar6 - Blocklisted process makes network request 5 IoCs
flow pid Process 11 1568 cmd.exe 12 1568 cmd.exe 13 1568 cmd.exe 14 1568 cmd.exe 15 1568 cmd.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1044 set thread context of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30 PID 1044 wrote to memory of 1568 1044 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\46bb7c8edade2a3cafb4e69bf3c64bcd.exe"C:\Users\Admin\AppData\Local\Temp\46bb7c8edade2a3cafb4e69bf3c64bcd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe2⤵
- Blocklisted process makes network request
PID:1568
-
-
C:\Users\Admin\AppData\Local\Temp\46bb7c8edade2a3cafb4e69bf3c64bcd.exeC:\Users\Admin\AppData\Local\Temp\46bb7c8edade2a3cafb4e69bf3c64bcd.exe 9291479671⤵PID:1620