Overview

overview

10

Static

static

SecuriteIn...58.exe

windows7_x64

10

SecuriteIn...58.exe

windows10_x64

10

Resubmissions

07-05-2021 04:03

210507-hng7crfr5s 10

05-05-2021 08:07

210505-38jr98rkr2 10

05-05-2021 05:50

210505-a1xkk2y93e 10

05-05-2021 05:21

210505-ldgzm9rsns 10

04-05-2021 21:54

210504-gxac1b6tga 10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    04-05-2021 21:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.ArtemisTrojan.25081.13158.exe

  • Size

    564KB

  • MD5

    43de3367faeffa04f28ad1e3e1f154eb

  • SHA1

    f75d1719bb9a2f6a628a521a827bfbf26e44b9a2

  • SHA256

    93d3f7173b0983274a93717c4c605ff9e85d6cce59a17bd965ca881e436c1954

  • SHA512

    53825602540b72bf294ee47f06a682b809140fd982f6ab99a02e5dc0251774c5eb7243ab2117218f54512e2ee59e100d3644bbc509d40db7da9f52dd72b67069

Score
10/10
bazarloaderdropperloader

Malware Config

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Bazar/Team9 Loader payload 2 IoCs
  • Tries to connect to .bazar domain 64 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.ArtemisTrojan.25081.13158.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.ArtemisTrojan.25081.13158.exe"
    1⤵
    • Modifies system certificate store
    PID:2004
  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.ArtemisTrojan.25081.13158.exe
    C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.ArtemisTrojan.25081.13158.exe 1983936737
    1⤵
      PID:1088

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Install Root Certificate

    1
    T1130

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1088-61-0x0000000000360000-0x000000000039E000-memory.dmp
      Filesize

      248KB

      Download
    • memory/2004-59-0x0000000000350000-0x000000000038E000-memory.dmp
      Filesize

      248KB

      Download
    • memory/2004-60-0x000007FEFC411000-0x000007FEFC413000-memory.dmp
      Filesize

      8KB

      Download