Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
29-04-2021 00:24
Static task
static1
Behavioral task
behavioral1
Sample
ee1db7f0ad39df1af6eb5166447b1471.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ee1db7f0ad39df1af6eb5166447b1471.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
ee1db7f0ad39df1af6eb5166447b1471.exe
-
Size
386KB
-
MD5
ee1db7f0ad39df1af6eb5166447b1471
-
SHA1
9111bc344d733b1aba0aef2e81b5e9fbc9d01e8f
-
SHA256
842e396f05d590ec88da30e6180dfb29a7aec16e3ef5b49398fde8b79e4090bd
-
SHA512
26366e9fbc998105a4ee00ab91abb4110fc8849a513a29821e3611a3762cfb083722bc83836704de87531e9164d648e16b6a381daa3f046ead17ac4422fab0e0
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 3 IoCs
resource yara_rule behavioral1/memory/1280-63-0x000000004AB20000-0x000000004AB71000-memory.dmp BazarBackdoorVar4 behavioral1/memory/1280-64-0x000000004AB44554-mapping.dmp BazarBackdoorVar4 behavioral1/memory/1280-65-0x000000004AB20000-0x000000004AB71000-memory.dmp BazarBackdoorVar4 -
Bazar/Team9 Loader payload 2 IoCs
resource yara_rule behavioral1/memory/1736-60-0x0000000000260000-0x000000000029E000-memory.dmp BazarLoaderVar6 behavioral1/memory/1600-67-0x0000000000250000-0x000000000028E000-memory.dmp BazarLoaderVar6 -
Blocklisted process makes network request 8 IoCs
flow pid Process 8 1280 cmd.exe 10 1280 cmd.exe 14 1280 cmd.exe 15 1280 cmd.exe 16 1280 cmd.exe 17 1280 cmd.exe 18 1280 cmd.exe 19 1280 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1736 set thread context of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 1736 ee1db7f0ad39df1af6eb5166447b1471.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29 PID 1736 wrote to memory of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe"C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe2⤵
- Blocklisted process makes network request
PID:1280
-
-
C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exeC:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe 1417811391⤵PID:1600