Resubmissions

29-04-2021 00:24

210429-zlrd5mr8ke 10

27-04-2021 19:02

210427-4qrnfw951s 10

Analysis

  • max time kernel
    30s
  • max time network
    111s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    27-04-2021 19:02

General

  • Target

    ee1db7f0ad39df1af6eb5166447b1471.exe

  • Size

    386KB

  • MD5

    ee1db7f0ad39df1af6eb5166447b1471

  • SHA1

    9111bc344d733b1aba0aef2e81b5e9fbc9d01e8f

  • SHA256

    842e396f05d590ec88da30e6180dfb29a7aec16e3ef5b49398fde8b79e4090bd

  • SHA512

    26366e9fbc998105a4ee00ab91abb4110fc8849a513a29821e3611a3762cfb083722bc83836704de87531e9164d648e16b6a381daa3f046ead17ac4422fab0e0

Malware Config

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

  • BazarBackdoor

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

  • Bazar/Team9 Backdoor payload 3 IoCs
  • Bazar/Team9 Loader payload 2 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe
    "C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe
      2⤵
      • Blocklisted process makes network request
      PID:3816
  • C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe
    C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe 1751248267
    1⤵
      PID:3776

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2016-114-0x000001A9E7FC0000-0x000001A9E7FFE000-memory.dmp
      Filesize

      248KB

    • memory/3776-116-0x000001E8F7A30000-0x000001E8F7A6E000-memory.dmp
      Filesize

      248KB

    • memory/3816-118-0x00007FF6EBA50000-0x00007FF6EBAA1000-memory.dmp
      Filesize

      324KB

    • memory/3816-119-0x00007FF6EBA74554-mapping.dmp
    • memory/3816-120-0x00007FF6EBA50000-0x00007FF6EBAA1000-memory.dmp
      Filesize

      324KB