Analysis
-
max time kernel
70s -
max time network
88s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
29-04-2021 00:24
Static task
static1
Behavioral task
behavioral1
Sample
tret.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
tret.exe
Resource
win10v20210408
General
-
Target
tret.exe
-
Size
386KB
-
MD5
ee1db7f0ad39df1af6eb5166447b1471
-
SHA1
9111bc344d733b1aba0aef2e81b5e9fbc9d01e8f
-
SHA256
842e396f05d590ec88da30e6180dfb29a7aec16e3ef5b49398fde8b79e4090bd
-
SHA512
26366e9fbc998105a4ee00ab91abb4110fc8849a513a29821e3611a3762cfb083722bc83836704de87531e9164d648e16b6a381daa3f046ead17ac4422fab0e0
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-64-0x000000004A620000-0x000000004A671000-memory.dmp BazarBackdoorVar4 behavioral1/memory/1684-65-0x000000004A644554-mapping.dmp BazarBackdoorVar4 behavioral1/memory/1684-66-0x000000004A620000-0x000000004A671000-memory.dmp BazarBackdoorVar4 -
Bazar/Team9 Loader payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1056-59-0x0000000001B90000-0x0000000001BCE000-memory.dmp BazarLoaderVar6 behavioral1/memory/1608-62-0x0000000001B80000-0x0000000001BBE000-memory.dmp BazarLoaderVar6 -
Blocklisted process makes network request 5 IoCs
Processes:
cmd.exeflow pid process 12 1684 cmd.exe 13 1684 cmd.exe 14 1684 cmd.exe 15 1684 cmd.exe 16 1684 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tret.exedescription pid process target process PID 1056 set thread context of 1684 1056 tret.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
tret.exepid process 1056 tret.exe 1056 tret.exe 1056 tret.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
tret.exedescription pid process target process PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe PID 1056 wrote to memory of 1684 1056 tret.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tret.exe"C:\Users\Admin\AppData\Local\Temp\tret.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe2⤵
- Blocklisted process makes network request
-
C:\Users\Admin\AppData\Local\Temp\tret.exeC:\Users\Admin\AppData\Local\Temp\tret.exe 17492366041⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
8a9f8af922615629fc40c95ccc6203a7
SHA1f6a42a78d12a8b9ed60d2ef7df2c7d4df80a3797
SHA2560c2e4dafa5a93a48948bb69814f92719c9ee8d48d0fe457eec1b2affacb43a0a
SHA51232fa9510f2609ff04ed9e1d16563da4a7cd7f40d1bfdbf24c13689b3cdb8a0dc76d60358fc3869986a2c8a41731294e5546e5f354c6f6ae7dc38167e7cdb866f
-
memory/1056-59-0x0000000001B90000-0x0000000001BCE000-memory.dmpFilesize
248KB
-
memory/1056-61-0x000007FEFBFF1000-0x000007FEFBFF3000-memory.dmpFilesize
8KB
-
memory/1608-62-0x0000000001B80000-0x0000000001BBE000-memory.dmpFilesize
248KB
-
memory/1684-64-0x000000004A620000-0x000000004A671000-memory.dmpFilesize
324KB
-
memory/1684-65-0x000000004A644554-mapping.dmp
-
memory/1684-66-0x000000004A620000-0x000000004A671000-memory.dmpFilesize
324KB