bazarbackdoor | e039822594278b0b37f3ceaa936cecc416197925407c13389b1d01b8be5a741b

General

Target

bakjr.exe

Score

10^/10

bazarbackdoor bazarloader backdoor dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3984-118-0x00007FF6A7700000-0x00007FF6A7751000-memory.dmp	BazarBackdoorVar4
behavioral2/memory/3984-119-0x00007FF6A7724064-mapping.dmp	BazarBackdoorVar4
behavioral2/memory/3984-120-0x00007FF6A7700000-0x00007FF6A7751000-memory.dmp	BazarBackdoorVar4

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4656-114-0x000001CDAE9D0000-0x000001CDAEA0D000-memory.dmp	BazarLoaderVar6
behavioral2/memory/3964-116-0x00000210851B0000-0x00000210851ED000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 6 IoCs

Processes:

cmd.exe

flow pid process

18 3984 cmd.exe
19 3984 cmd.exe
20 3984 cmd.exe
21 3984 cmd.exe
22 3984 cmd.exe
23 3984 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

bakjr.exe

description pid process target process

PID 4656 set thread context of 3984 4656 bakjr.exe cmd.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

bakjr.exe

pid process

4656 bakjr.exe
4656 bakjr.exe
4656 bakjr.exe
4656 bakjr.exe
4656 bakjr.exe
4656 bakjr.exe

flow	pid	process
18	3984	cmd.exe
19	3984	cmd.exe
20	3984	cmd.exe
21	3984	cmd.exe
22	3984	cmd.exe
23	3984	cmd.exe

description	pid	process	target process
PID 4656 set thread context of 3984	4656	bakjr.exe	cmd.exe

pid	process
4656	bakjr.exe
4656	bakjr.exe
4656	bakjr.exe
4656	bakjr.exe
4656	bakjr.exe
4656	bakjr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bakjr.exe

description	pid	process	target process
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe
PID 4656 wrote to memory of 3984	4656	bakjr.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\bakjr.exe
"C:\Users\Admin\AppData\Local\Temp\bakjr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe
2⤵
- Blocklisted process makes network request
PID:3984

C:\Users\Admin\AppData\Local\Temp\bakjr.exe
C:\Users\Admin\AppData\Local\Temp\bakjr.exe 265991438
1⤵
PID:3964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3964-116-0x00000210851B0000-0x00000210851ED000-memory.dmp

Filesize
244KB

Download
memory/3984-118-0x00007FF6A7700000-0x00007FF6A7751000-memory.dmp

Filesize
324KB

Download
memory/3984-119-0x00007FF6A7724064-mapping.dmp

Download
memory/3984-120-0x00007FF6A7700000-0x00007FF6A7751000-memory.dmp

Filesize
324KB

Download
memory/4656-114-0x000001CDAE9D0000-0x000001CDAEA0D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads