bazarbackdoor | 0a87bd3bb60320b21e493341b70519af4e46c2e969038d6d89b536cd37aa11d9

General

Target

vegas.dll
Size

513KB
MD5

b80f4b91c29963df1cfd0d0a8a30e5c6
SHA1

09c6ae06e0c10672d91f6850118f41dc3dd66e72
SHA256

0a87bd3bb60320b21e493341b70519af4e46c2e969038d6d89b536cd37aa11d9
SHA512

bdcd3009ed3499055cf73ef1c4dd4bd0942c8b81c395cecf3c9da790e4867055059d10b05451476d7da98bbbf472c40536e7a09158b5de92c57a74e36396d10c

Score

10^/10

bazarbackdoor backdoor

Malware Config

Signatures

BazarBackdoor 5 IoCs

Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

backdoor bazarbackdoor

Processes:

description	flow	ioc
HTTP URL	23	https://54.163.9.216/4be656f0db4e6d3caa7f96acd7029340/4
HTTP URL	24	https://54.163.9.216/4be656f0db4e6d3caa7f96acd7029340/4
HTTP URL	25	https://54.163.9.216/4be656f0db4e6d3caa7f96acd7029340/4
HTTP URL	26	https://54.163.9.216/4be656f0db4e6d3caa7f96acd7029340/2
HTTP URL	27	https://54.163.9.216/4be656f0db4e6d3caa7f96acd7029340/3

Blocklisted process makes network request 8 IoCs

Processes:

rundll32.execmd.exe

flow pid process

17 3216 rundll32.exe
19 3216 rundll32.exe
22 3216 rundll32.exe
23 1172 cmd.exe
24 1172 cmd.exe
25 1172 cmd.exe
26 1172 cmd.exe
27 1172 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3216 set thread context of 1172 3216 rundll32.exe cmd.exe

flow	pid	process
17	3216	rundll32.exe
19	3216	rundll32.exe
22	3216	rundll32.exe
23	1172	cmd.exe
24	1172	cmd.exe
25	1172	cmd.exe
26	1172	cmd.exe
27	1172	cmd.exe

description	pid	process	target process
PID 3216 set thread context of 1172	3216	rundll32.exe	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3212 wrote to memory of 3216	3212	rundll32.exe	rundll32.exe
PID 3212 wrote to memory of 3216	3212	rundll32.exe	rundll32.exe
PID 3212 wrote to memory of 3216	3212	rundll32.exe	rundll32.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe
PID 3216 wrote to memory of 1172	3216	rundll32.exe	cmd.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vegas.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3212

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vegas.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3216

C:\Windows\SysWOW64\cmd.exe
C:\Windows\System32\cmd.exe
3⤵
- Blocklisted process makes network request
PID:1172

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\vegas.dll,PluginInit 108342764
1⤵
PID:3960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-118-0x0000000000230000-0x000000000026F000-memory.dmp

Filesize
252KB

Download
memory/1172-119-0x000000000024BB2D-mapping.dmp

Download
memory/1172-120-0x0000000000230000-0x000000000026F000-memory.dmp

Filesize
252KB

Download
memory/3216-114-0x0000000000000000-mapping.dmp

Download
memory/3216-115-0x00000000742C0000-0x00000000742E8000-memory.dmp

Filesize
160KB

Download
memory/3216-116-0x00000000742C0000-0x000000007444C000-memory.dmp

Filesize
1.5MB

Download
memory/3216-117-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/3960-122-0x00000000742C0000-0x000000007444C000-memory.dmp

Filesize
1.5MB

Download
memory/3960-123-0x0000000003200000-0x000000000334A000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing