Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
07-04-2021 04:47
General
-
Target
dl8.exe
-
Size
271KB
-
MD5
0a6e27aa3415f502af6585bddf7e0d3e
-
SHA1
a8bdb01ef8a6e75ec200c5d4f6d9f32539dca9f2
-
SHA256
210c46aae3d71ecbac79447d124d895dded804c08342b17258cd4b400b0bebe0
-
SHA512
abd3b3d4e6251fe5231bf45186b43cb1d4aa5dc36fd79e71e4bf010d9adfbf2c6837d4606795be97a00911cd5d06326d7ed38656dbe7827ed33a59b0f140d479
Score
8/10
Malware Config
Signatures
-
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dl8.exe"C:\Users\Admin\AppData\Local\Temp\dl8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dl8.exe"C:\Users\Admin\AppData\Local\Temp\dl8.exe"2⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\VideoLAN\VLC\NEWS.txt1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1144-2-0x000001DDDB3D0000-0x000001DDDB400000-memory.dmpFilesize
192KB
-
memory/1660-3-0x0000000000000000-mapping.dmp
-
memory/1660-4-0x00000149AFF70000-0x00000149AFFA0000-memory.dmpFilesize
192KB