Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-04-2021 19:02
Static task
static1
Behavioral task
behavioral1
Sample
ee1db7f0ad39df1af6eb5166447b1471.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ee1db7f0ad39df1af6eb5166447b1471.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
ee1db7f0ad39df1af6eb5166447b1471.exe
-
Size
386KB
-
MD5
ee1db7f0ad39df1af6eb5166447b1471
-
SHA1
9111bc344d733b1aba0aef2e81b5e9fbc9d01e8f
-
SHA256
842e396f05d590ec88da30e6180dfb29a7aec16e3ef5b49398fde8b79e4090bd
-
SHA512
26366e9fbc998105a4ee00ab91abb4110fc8849a513a29821e3611a3762cfb083722bc83836704de87531e9164d648e16b6a381daa3f046ead17ac4422fab0e0
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 3 IoCs
resource yara_rule behavioral1/memory/1540-62-0x000000004A630000-0x000000004A681000-memory.dmp BazarBackdoorVar4 behavioral1/memory/1540-63-0x000000004A654554-mapping.dmp BazarBackdoorVar4 behavioral1/memory/1540-65-0x000000004A630000-0x000000004A681000-memory.dmp BazarBackdoorVar4 -
Bazar/Team9 Loader payload 2 IoCs
resource yara_rule behavioral1/memory/1096-59-0x0000000000360000-0x000000000039E000-memory.dmp BazarLoaderVar6 behavioral1/memory/1556-66-0x0000000000280000-0x00000000002BE000-memory.dmp BazarLoaderVar6 -
Blocklisted process makes network request 5 IoCs
flow pid Process 11 1540 cmd.exe 12 1540 cmd.exe 13 1540 cmd.exe 14 1540 cmd.exe 15 1540 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1096 set thread context of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 1096 ee1db7f0ad39df1af6eb5166447b1471.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30 PID 1096 wrote to memory of 1540 1096 ee1db7f0ad39df1af6eb5166447b1471.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe"C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe2⤵
- Blocklisted process makes network request
PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exeC:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe 2162911411⤵PID:1556