bazarbackdoor | 842e396f05d590ec88da30e6180dfb29a7aec16e3ef5b49398fde8b79e4090bd

General

Target

ee1db7f0ad39df1af6eb5166447b1471.exe
Size

386KB
MD5

ee1db7f0ad39df1af6eb5166447b1471
SHA1

9111bc344d733b1aba0aef2e81b5e9fbc9d01e8f
SHA256

842e396f05d590ec88da30e6180dfb29a7aec16e3ef5b49398fde8b79e4090bd
SHA512

26366e9fbc998105a4ee00ab91abb4110fc8849a513a29821e3611a3762cfb083722bc83836704de87531e9164d648e16b6a381daa3f046ead17ac4422fab0e0

Score

10^/10

bazarbackdoor bazarloader backdoor dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1280-63-0x000000004AB20000-0x000000004AB71000-memory.dmp	BazarBackdoorVar4
behavioral1/memory/1280-64-0x000000004AB44554-mapping.dmp	BazarBackdoorVar4
behavioral1/memory/1280-65-0x000000004AB20000-0x000000004AB71000-memory.dmp	BazarBackdoorVar4

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1736-60-0x0000000000260000-0x000000000029E000-memory.dmp	BazarLoaderVar6
behavioral1/memory/1600-67-0x0000000000250000-0x000000000028E000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 8 IoCs

Processes:

cmd.exe

flow pid process

8 1280 cmd.exe
10 1280 cmd.exe
14 1280 cmd.exe
15 1280 cmd.exe
16 1280 cmd.exe
17 1280 cmd.exe
18 1280 cmd.exe
19 1280 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ee1db7f0ad39df1af6eb5166447b1471.exe

description pid process target process

PID 1736 set thread context of 1280 1736 ee1db7f0ad39df1af6eb5166447b1471.exe cmd.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

ee1db7f0ad39df1af6eb5166447b1471.exe

pid process

1736 ee1db7f0ad39df1af6eb5166447b1471.exe
1736 ee1db7f0ad39df1af6eb5166447b1471.exe
1736 ee1db7f0ad39df1af6eb5166447b1471.exe

flow	pid	process
8	1280	cmd.exe
10	1280	cmd.exe
14	1280	cmd.exe
15	1280	cmd.exe
16	1280	cmd.exe
17	1280	cmd.exe
18	1280	cmd.exe
19	1280	cmd.exe

description	pid	process	target process
PID 1736 set thread context of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe

pid	process
1736	ee1db7f0ad39df1af6eb5166447b1471.exe
1736	ee1db7f0ad39df1af6eb5166447b1471.exe
1736	ee1db7f0ad39df1af6eb5166447b1471.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ee1db7f0ad39df1af6eb5166447b1471.exe

description	pid	process	target process
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe
PID 1736 wrote to memory of 1280	1736	ee1db7f0ad39df1af6eb5166447b1471.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe
"C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe
2⤵
- Blocklisted process makes network request
PID:1280

C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe
C:\Users\Admin\AppData\Local\Temp\ee1db7f0ad39df1af6eb5166447b1471.exe 141781139
1⤵
PID:1600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
7749288d051bdf72a06cf8f64c8b499b

SHA1
8d726d81980d77075b10406a0c08736adf7be658

SHA256
e1c5cb975b355a89f4c3c5ab6eff982ee2e273277ebba3dd8befb828ccccfe74

SHA512
5d42b172b03dd9ce80dfdc05a114a24f8f6633da89c1131d44a01a6500a270bb363489f656d7ceb667d97c35dae7b82c4315407e3c926dd7042111962429e127

Download Submit
memory/1280-63-0x000000004AB20000-0x000000004AB71000-memory.dmp

Filesize
324KB

Download
memory/1280-64-0x000000004AB44554-mapping.dmp

Download
memory/1280-65-0x000000004AB20000-0x000000004AB71000-memory.dmp

Filesize
324KB

Download
memory/1600-67-0x0000000000250000-0x000000000028E000-memory.dmp

Filesize
248KB

Download
memory/1736-60-0x0000000000260000-0x000000000029E000-memory.dmp

Filesize
248KB

Download
memory/1736-62-0x000007FEFBAA1000-0x000007FEFBAA3000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads