bazarbackdoor | hxxp://176[.]111[.]174[.]59/uploads/files/teret[.]exe

General

Target

http://176.111.174.59/uploads/files/teret.exe
Sample

210504-wtf6525d6x

Score

10^/10

bazarbackdoor bazarloader backdoor dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2252-125-0x00007FF6F42A4474-mapping.dmp	BazarBackdoorVar4
behavioral1/memory/2252-124-0x00007FF6F4280000-0x00007FF6F42D1000-memory.dmp	BazarBackdoorVar4
behavioral1/memory/2252-126-0x00007FF6F4280000-0x00007FF6F42D1000-memory.dmp	BazarBackdoorVar4

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3488-119-0x0000022FBBEF0000-0x0000022FBBF2E000-memory.dmp	BazarLoaderVar6
behavioral1/memory/3980-121-0x0000026D966D0000-0x0000026D9670E000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 4 IoCs

Processes:

cmd.exe

flow pid process

29 2252 cmd.exe
32 2252 cmd.exe
33 2252 cmd.exe
34 2252 cmd.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

teret.exeteret.exe

pid process

3488 teret.exe
3980 teret.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

teret.exe

description pid process target process

PID 3488 set thread context of 2252 3488 teret.exe cmd.exe

flow	pid	process
29	2252	cmd.exe
32	2252	cmd.exe
33	2252	cmd.exe
34	2252	cmd.exe

pid	process
3488	teret.exe
3980	teret.exe

description	pid	process	target process
PID 3488 set thread context of 2252	3488	teret.exe	cmd.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 6ead5207ab2cd701	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0d0d6fb1f41d701	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000003523317e692fbab804336796e3a6d9ff17d3ea2c1d5782d72fb31cb6c332e4000000000e8000000002000020000000169763f801db9601ea6fe74df84aefbd46a54c2bc1856d8d0b693cf066ee90d9200000005bc2a09d9e7de67df07e0a36db3a9aab9534dba5eff9aadf993064e7d9c7bbb4400000007b97eb47a5b13a701afb6e22dd9cdb5084e14bfa42c27c549b09e38f86284c1280afe7a42c21acf11833af9484abea975736cf3f5779eae52ee8eb2c6fcf2d30	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000e5d17d2202eb5cee8742ffb8d59d3dcfb7d0646a76a3eb4801257f5394002dbd000000000e80000000020000200000008918897d963e77fd4a867669a396b7716e47362ce96b1b99e35071b85f2b59762000000053fefcd5fa5ce13c8578e1d4f83553ee350eee0d92d7142cea925c09f262856f4000000074b926580ae4d04943cb8f73385e8cf202cac82a9514ab25278e17a17848abb78f927fbb1baadc807a2551c8fc9d61a8da72bffee04a78af437b1ea1fb01ede3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4175163175"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30884127"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30884127"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30884127"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40d7b7fb1f41d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23C19FAE-AD13-11EB-B2DB-EA801B2465EB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4175163175"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4213132139"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{3FA84E3F-4312-4CA9-AB8D-1AD142956FB1}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

teret.exe

pid process

3488 teret.exe
3488 teret.exe
3488 teret.exe
3488 teret.exe
3488 teret.exe
3488 teret.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

672 iexplore.exe
672 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

672 iexplore.exe
672 iexplore.exe
3940 IEXPLORE.EXE
3940 IEXPLORE.EXE

pid	process
3488	teret.exe
3488	teret.exe
3488	teret.exe
3488	teret.exe
3488	teret.exe
3488	teret.exe

pid	process
672	iexplore.exe
672	iexplore.exe

pid	process
672	iexplore.exe
672	iexplore.exe
3940	IEXPLORE.EXE
3940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exeteret.exe

description	pid	process	target process
PID 672 wrote to memory of 3940	672	iexplore.exe	IEXPLORE.EXE
PID 672 wrote to memory of 3940	672	iexplore.exe	IEXPLORE.EXE
PID 672 wrote to memory of 3940	672	iexplore.exe	IEXPLORE.EXE
PID 672 wrote to memory of 3488	672	iexplore.exe	teret.exe
PID 672 wrote to memory of 3488	672	iexplore.exe	teret.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe
PID 3488 wrote to memory of 2252	3488	teret.exe	cmd.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://176.111.174.59/uploads/files/teret.exe
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:672

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:672 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3940

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\teret.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\teret.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3488

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe
3⤵
- Blocklisted process makes network request
PID:2252

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\teret.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\teret.exe 297517731
1⤵
- Executes dropped EXE
PID:3980

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
10987a1d727697d22e9613985bf39eba

SHA1
d92fa559cdea14bdc068eb5388f4a8725d9d290c

SHA256
8c026af272e0d8eae1ec8978047926e4bbdb2a7ebe0207a738307150e2ed0063

SHA512
31910362ff1a6afe47a6abe7d77d1056eb1a1531cc027ae33bb34e1b4b788cd7efe2292278b02548e72b1441c86f85a3376ed46edf4c58a247febf4da91dfb87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
9b6847f795a718357a6f68c4d571f6eb

SHA1
3b3e36142b606d11e9009e7128068965e282045e

SHA256
f83dc4b6ff2bb2d05b8ae36132bbb6f0295351e647091208cfe9ecfa0f1104c1

SHA512
9aac47a67f7bdb6b82c8d8db41ffb11570527526de32cbcde87fe08f41bfb218734afe1d218046dc8d72a7db1afc3a1417586028139a5bbc8b3fb8f0db28d8f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\teret.exe
MD5
43de3367faeffa04f28ad1e3e1f154eb

SHA1
f75d1719bb9a2f6a628a521a827bfbf26e44b9a2

SHA256
93d3f7173b0983274a93717c4c605ff9e85d6cce59a17bd965ca881e436c1954

SHA512
53825602540b72bf294ee47f06a682b809140fd982f6ab99a02e5dc0251774c5eb7243ab2117218f54512e2ee59e100d3644bbc509d40db7da9f52dd72b67069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\teret.exe
MD5
43de3367faeffa04f28ad1e3e1f154eb

SHA1
f75d1719bb9a2f6a628a521a827bfbf26e44b9a2

SHA256
93d3f7173b0983274a93717c4c605ff9e85d6cce59a17bd965ca881e436c1954

SHA512
53825602540b72bf294ee47f06a682b809140fd982f6ab99a02e5dc0251774c5eb7243ab2117218f54512e2ee59e100d3644bbc509d40db7da9f52dd72b67069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\teret.exe.8bwzq9j.partial
MD5
43de3367faeffa04f28ad1e3e1f154eb

SHA1
f75d1719bb9a2f6a628a521a827bfbf26e44b9a2

SHA256
93d3f7173b0983274a93717c4c605ff9e85d6cce59a17bd965ca881e436c1954

SHA512
53825602540b72bf294ee47f06a682b809140fd982f6ab99a02e5dc0251774c5eb7243ab2117218f54512e2ee59e100d3644bbc509d40db7da9f52dd72b67069

Download Submit
memory/672-114-0x00007FFD1F1F0000-0x00007FFD1F25B000-memory.dmp

Filesize
428KB

Download
memory/2252-125-0x00007FF6F42A4474-mapping.dmp

Download
memory/2252-124-0x00007FF6F4280000-0x00007FF6F42D1000-memory.dmp

Filesize
324KB

Download
memory/2252-126-0x00007FF6F4280000-0x00007FF6F42D1000-memory.dmp

Filesize
324KB

Download
memory/3488-117-0x0000000000000000-mapping.dmp

Download
memory/3488-119-0x0000022FBBEF0000-0x0000022FBBF2E000-memory.dmp

Filesize
248KB

Download
memory/3940-115-0x0000000000000000-mapping.dmp

Download
memory/3980-121-0x0000026D966D0000-0x0000026D9670E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads