Analysis
-
max time kernel
116s -
max time network
115s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
01-04-2021 06:55
Static task
static1
Behavioral task
behavioral1
Sample
rt3ret3.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
rt3ret3.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
rt3ret3.exe
-
Size
236KB
-
MD5
efa4b2e7d7016a1f80efff5840de3a18
-
SHA1
04606786daa6313867c7ada1f0c9c925d9b602fb
-
SHA256
291c573996c647508544e8e21bd2764e6e4c834d53d6d2c8903a0001c783764b
-
SHA512
11446166922efb329d547ce329fb3ed70a3a99c1c037533beaecefd16d4a67c9dc9201592b0428a06fd956e4bb5caf3f7997a86200792e3e29a041f0963b2ced
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 1 IoCs
resource yara_rule behavioral1/memory/1908-2-0x0000000180000000-0x0000000180032000-memory.dmp BazarLoaderVar1 -
Executes dropped EXE 2 IoCs
pid Process 1076 TSDFD62.exe 1080 TSDFD62.exe -
Loads dropped DLL 4 IoCs
pid Process 768 cmd.exe 768 cmd.exe 904 cmd.exe 904 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\M6ZZR1BFFQ = "cmd.exe /c reg.exe add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v MUCLW1SOI /t REG_SZ /d \"\\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TSDFD62.exe\\\" M3OS\" & start \"H\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\TSDFD62.exe\" M3OS" TSDFD62.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 1212 PING.EXE 1152 PING.EXE 1452 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1908 rt3ret3.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1908 wrote to memory of 324 1908 rt3ret3.exe 29 PID 1908 wrote to memory of 324 1908 rt3ret3.exe 29 PID 1908 wrote to memory of 324 1908 rt3ret3.exe 29 PID 324 wrote to memory of 1212 324 cmd.exe 31 PID 324 wrote to memory of 1212 324 cmd.exe 31 PID 324 wrote to memory of 1212 324 cmd.exe 31 PID 324 wrote to memory of 1896 324 cmd.exe 32 PID 324 wrote to memory of 1896 324 cmd.exe 32 PID 324 wrote to memory of 1896 324 cmd.exe 32 PID 1896 wrote to memory of 768 1896 rt3ret3.exe 33 PID 1896 wrote to memory of 768 1896 rt3ret3.exe 33 PID 1896 wrote to memory of 768 1896 rt3ret3.exe 33 PID 768 wrote to memory of 1152 768 cmd.exe 35 PID 768 wrote to memory of 1152 768 cmd.exe 35 PID 768 wrote to memory of 1152 768 cmd.exe 35 PID 768 wrote to memory of 1076 768 cmd.exe 36 PID 768 wrote to memory of 1076 768 cmd.exe 36 PID 768 wrote to memory of 1076 768 cmd.exe 36 PID 1076 wrote to memory of 904 1076 TSDFD62.exe 37 PID 1076 wrote to memory of 904 1076 TSDFD62.exe 37 PID 1076 wrote to memory of 904 1076 TSDFD62.exe 37 PID 904 wrote to memory of 1452 904 cmd.exe 39 PID 904 wrote to memory of 1452 904 cmd.exe 39 PID 904 wrote to memory of 1452 904 cmd.exe 39 PID 904 wrote to memory of 1080 904 cmd.exe 40 PID 904 wrote to memory of 1080 904 cmd.exe 40 PID 904 wrote to memory of 1080 904 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\rt3ret3.exe"C:\Users\Admin\AppData\Local\Temp\rt3ret3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\cmd.execmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\rt3ret3.exe K4CWXJ2⤵
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\system32\PING.EXEping 8.8.8.8 -n 23⤵
- Runs ping.exe
PID:1212
-
-
C:\Users\Admin\AppData\Local\Temp\rt3ret3.exeC:\Users\Admin\AppData\Local\Temp\rt3ret3.exe K4CWXJ3⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\system32\cmd.execmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\TSDFD62.exe TQ75M5A4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\system32\PING.EXEping 8.8.8.8 -n 25⤵
- Runs ping.exe
PID:1152
-
-
C:\Users\Admin\AppData\Local\Temp\TSDFD62.exeC:\Users\Admin\AppData\Local\Temp\TSDFD62.exe TQ75M5A5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\system32\cmd.execmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\TSDFD62.exe M3OS6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\system32\PING.EXEping 8.8.8.8 -n 27⤵
- Runs ping.exe
PID:1452
-
-
C:\Users\Admin\AppData\Local\Temp\TSDFD62.exeC:\Users\Admin\AppData\Local\Temp\TSDFD62.exe M3OS7⤵
- Executes dropped EXE
PID:1080
-
-
-
-
-
-