bazarbackdoor | fd001fb71e9faa68c6e53162ed0554fd6f16a0e381aa280cea397b3d74bb62eb

General

Target

baza-or-cs.dll
Size

153KB
MD5

ea3612919bf05b66e9a608bee742a422
SHA1

032747a1658fea7f8d624c11ae965f3218f96909
SHA256

fd001fb71e9faa68c6e53162ed0554fd6f16a0e381aa280cea397b3d74bb62eb
SHA512

f2f049ef68cd5c06511dab2ef82a67e0aa44ac583ec5e84ec7cba1627f47c31a748ad58e1b065401b162a4266f753ac842efceef7cbe33efb0a9d8399365e2c7

Score

10^/10

bazarbackdoor bazarloader backdoor dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1832-116-0x00007FF6BDF50000-0x00007FF6BDFA1000-memory.dmp	BazarBackdoorVar4
behavioral2/memory/1832-117-0x00007FF6BDF74550-mapping.dmp	BazarBackdoorVar4
behavioral2/memory/1832-118-0x00007FF6BDF50000-0x00007FF6BDFA1000-memory.dmp	BazarBackdoorVar4

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4436-114-0x000002691AF40000-0x000002691B01C000-memory.dmp	BazarLoaderVar6
behavioral2/memory/3784-115-0x0000025958800000-0x00000259588DC000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

11 4436 rundll32.exe
13 4436 rundll32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 4436 set thread context of 1832 4436 rundll32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

4436 rundll32.exe
4436 rundll32.exe
4436 rundll32.exe
4436 rundll32.exe
4436 rundll32.exe
4436 rundll32.exe

flow	pid	process
11	4436	rundll32.exe
13	4436	rundll32.exe

description	pid	process	target process
PID 4436 set thread context of 1832	4436	rundll32.exe	svchost.exe

pid	process
4436	rundll32.exe
4436	rundll32.exe
4436	rundll32.exe
4436	rundll32.exe
4436	rundll32.exe
4436	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe
PID 4436 wrote to memory of 1832	4436	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\baza-or-cs.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
2⤵
PID:1832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\baza-or-cs.dll,#1 110369929
1⤵
PID:3784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-116-0x00007FF6BDF50000-0x00007FF6BDFA1000-memory.dmp

Filesize
324KB

Download
memory/1832-117-0x00007FF6BDF74550-mapping.dmp

Download
memory/1832-118-0x00007FF6BDF50000-0x00007FF6BDFA1000-memory.dmp

Filesize
324KB

Download
memory/3784-115-0x0000025958800000-0x00000259588DC000-memory.dmp

Filesize
880KB

Download
memory/4436-114-0x000002691AF40000-0x000002691B01C000-memory.dmp

Filesize
880KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads