Analysis
-
max time kernel
24s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-04-2021 00:24
Static task
static1
Behavioral task
behavioral1
Sample
tret.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
tret.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
tret.exe
-
Size
386KB
-
MD5
ee1db7f0ad39df1af6eb5166447b1471
-
SHA1
9111bc344d733b1aba0aef2e81b5e9fbc9d01e8f
-
SHA256
842e396f05d590ec88da30e6180dfb29a7aec16e3ef5b49398fde8b79e4090bd
-
SHA512
26366e9fbc998105a4ee00ab91abb4110fc8849a513a29821e3611a3762cfb083722bc83836704de87531e9164d648e16b6a381daa3f046ead17ac4422fab0e0
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1200-119-0x00007FF6894E4554-mapping.dmp BazarBackdoorVar4 behavioral2/memory/1200-118-0x00007FF6894C0000-0x00007FF689511000-memory.dmp BazarBackdoorVar4 behavioral2/memory/1200-120-0x00007FF6894C0000-0x00007FF689511000-memory.dmp BazarBackdoorVar4 -
Bazar/Team9 Loader payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/784-114-0x0000018476B70000-0x0000018476BAE000-memory.dmp BazarLoaderVar6 behavioral2/memory/2376-116-0x000001C0F4C00000-0x000001C0F4C3E000-memory.dmp BazarLoaderVar6 -
Blocklisted process makes network request 4 IoCs
Processes:
cmd.exeflow pid process 24 1200 cmd.exe 28 1200 cmd.exe 29 1200 cmd.exe 30 1200 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tret.exedescription pid process target process PID 784 set thread context of 1200 784 tret.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
tret.exepid process 784 tret.exe 784 tret.exe 784 tret.exe 784 tret.exe 784 tret.exe 784 tret.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
tret.exedescription pid process target process PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe PID 784 wrote to memory of 1200 784 tret.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tret.exe"C:\Users\Admin\AppData\Local\Temp\tret.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe2⤵
- Blocklisted process makes network request
-
C:\Users\Admin\AppData\Local\Temp\tret.exeC:\Users\Admin\AppData\Local\Temp\tret.exe 16078341381⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/784-114-0x0000018476B70000-0x0000018476BAE000-memory.dmpFilesize
248KB
-
memory/1200-119-0x00007FF6894E4554-mapping.dmp
-
memory/1200-118-0x00007FF6894C0000-0x00007FF689511000-memory.dmpFilesize
324KB
-
memory/1200-120-0x00007FF6894C0000-0x00007FF689511000-memory.dmpFilesize
324KB
-
memory/2376-116-0x000001C0F4C00000-0x000001C0F4C3E000-memory.dmpFilesize
248KB