Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-04-2021 06:31
General
-
Target
dl8.exe
-
Size
271KB
-
MD5
0a6e27aa3415f502af6585bddf7e0d3e
-
SHA1
a8bdb01ef8a6e75ec200c5d4f6d9f32539dca9f2
-
SHA256
210c46aae3d71ecbac79447d124d895dded804c08342b17258cd4b400b0bebe0
-
SHA512
abd3b3d4e6251fe5231bf45186b43cb1d4aa5dc36fd79e71e4bf010d9adfbf2c6837d4606795be97a00911cd5d06326d7ed38656dbe7827ed33a59b0f140d479
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 2 IoCs
-
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dl8.exe"C:\Users\Admin\AppData\Local\Temp\dl8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dl8.exe"C:\Users\Admin\AppData\Local\Temp\dl8.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1400-2-0x00000147BEBE0000-0x00000147BEC10000-memory.dmpFilesize
192KB
-
memory/3272-3-0x0000000000000000-mapping.dmp
-
memory/3272-4-0x000001D641A40000-0x000001D641A70000-memory.dmpFilesize
192KB