Analysis
- max time kernel
129s - max time network
129s - platform
windows10_x64 - resource
win10v20201028 - submitted
31/03/2021, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
46bb7c8edade2a3cafb4e69bf3c64bcd.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
46bb7c8edade2a3cafb4e69bf3c64bcd.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 46bb7c8edade2a3cafb4e69bf3c64bcd.exe
- Size 621KB
- Sample210331-pdvp58l57e
- SHA256 c8510031a868ab8ef2b11a4261d2aba8c9be252294780faea012bfa94c6d0c70
- MD5 46bb7c8edade2a3cafb4e69bf3c64bcd
- SHA1 495bdcb4c36c150f23c7e6156cc1486586e26b17
- SHA512 d40bc1325f87725da3714a59bba6064f0f75acae095a2bc7d03750d9236da4cc98107fcaf62c2e3dc3be8cc11ebb2929597beba261a04e9ccf409bd0547262bd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
- Bazar/Team9 Loader payload 2 IoCs
resource yara_rule behavioral2/memory/1148-2-0x000001D9D1ED0000-0x000001D9D1F04000-memory.dmp BazarLoaderVar6 behavioral2/memory/4076-11-0x000001CD0C9E0000-0x000001CD0CA14000-memory.dmp BazarLoaderVar6 - Blocklisted process makes network request 4 IoCs
flow pid Process 18 800 cmd.exe 19 800 cmd.exe 20 800 cmd.exe 21 800 cmd.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1148 set thread context of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80 PID 1148 wrote to memory of 800 1148 46bb7c8edade2a3cafb4e69bf3c64bcd.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\46bb7c8edade2a3cafb4e69bf3c64bcd.exe"C:\Users\Admin\AppData\Local\Temp\46bb7c8edade2a3cafb4e69bf3c64bcd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe2⤵
- Blocklisted process makes network request
PID:800
-
-
C:\Users\Admin\AppData\Local\Temp\46bb7c8edade2a3cafb4e69bf3c64bcd.exeC:\Users\Admin\AppData\Local\Temp\46bb7c8edade2a3cafb4e69bf3c64bcd.exe 23948426351⤵PID:4076