Analysis
-
max time kernel
112s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-04-2021 06:27
Behavioral task
behavioral1
Sample
bakjr.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bakjr.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
subscription_1618420095.xlsb
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
bakjr.exe
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 3 IoCs
resource yara_rule behavioral2/memory/3984-118-0x00007FF6A7700000-0x00007FF6A7751000-memory.dmp BazarBackdoorVar4 behavioral2/memory/3984-119-0x00007FF6A7724064-mapping.dmp BazarBackdoorVar4 behavioral2/memory/3984-120-0x00007FF6A7700000-0x00007FF6A7751000-memory.dmp BazarBackdoorVar4 -
Bazar/Team9 Loader payload 2 IoCs
resource yara_rule behavioral2/memory/4656-114-0x000001CDAE9D0000-0x000001CDAEA0D000-memory.dmp BazarLoaderVar6 behavioral2/memory/3964-116-0x00000210851B0000-0x00000210851ED000-memory.dmp BazarLoaderVar6 -
Blocklisted process makes network request 6 IoCs
flow pid Process 18 3984 cmd.exe 19 3984 cmd.exe 20 3984 cmd.exe 21 3984 cmd.exe 22 3984 cmd.exe 23 3984 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4656 set thread context of 3984 4656 bakjr.exe 79 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4656 bakjr.exe 4656 bakjr.exe 4656 bakjr.exe 4656 bakjr.exe 4656 bakjr.exe 4656 bakjr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79 PID 4656 wrote to memory of 3984 4656 bakjr.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\bakjr.exe"C:\Users\Admin\AppData\Local\Temp\bakjr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe2⤵
- Blocklisted process makes network request
PID:3984
-
-
C:\Users\Admin\AppData\Local\Temp\bakjr.exeC:\Users\Admin\AppData\Local\Temp\bakjr.exe 2659914381⤵PID:3964