738f4267728385be1d6336685338a0af96f09587218dbc6b3b88db07d1326877 | Triage

Analysis

max time kernel
64s
max time network
169s
platform
windows7_x64
resource
win7v20210408
submitted
21-07-2021 14:22

Sharing

Report Analysis Logs

General

Target

boysLove.jpg.dll
Size

454KB
MD5

a54bf8f8470245c908cc1de6063e04fc
SHA1

a02f9a05c2fb54d898b71da065e87501ab60828c
SHA256

738f4267728385be1d6336685338a0af96f09587218dbc6b3b88db07d1326877
SHA512

1905141e3000aa2296fff83e0d2f576a7b8e5f3ef26bd884476aa38bc4dbc53e61dc0c9a0f31a9e0d320d932758b2da43cb4e6986607000ffdebd83ec0244680

Score

8^/10

Malware Config

Signatures

Tries to connect to .bazar domain 36 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
23	greencloud46a.bazar
27	greencloud46a.bazar
36	whitestorm9p.bazar
52	yellowdownpour81.bazar
24	greencloud46a.bazar
28	greencloud46a.bazar
38	whitestorm9p.bazar
39	whitestorm9p.bazar
50	yellowdownpour81.bazar
25	greencloud46a.bazar
34	whitestorm9p.bazar
35	whitestorm9p.bazar
42	whitestorm9p.bazar
43	yellowdownpour81.bazar
44	yellowdownpour81.bazar
47	yellowdownpour81.bazar
48	yellowdownpour81.bazar
19	greencloud46a.bazar
22	greencloud46a.bazar
26	greencloud46a.bazar
33	whitestorm9p.bazar
37	whitestorm9p.bazar
41	whitestorm9p.bazar
45	yellowdownpour81.bazar
30	greencloud46a.bazar
20	greencloud46a.bazar
53	yellowdownpour81.bazar
21	greencloud46a.bazar
29	greencloud46a.bazar
31	whitestorm9p.bazar
32	whitestorm9p.bazar
40	whitestorm9p.bazar
46	yellowdownpour81.bazar
49	yellowdownpour81.bazar
51	yellowdownpour81.bazar
54	yellowdownpour81.bazar

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description flow ioc

HTTP URL 12 https://api.opennicproject.org/geoip/?bare&ipv=4

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\boysLove.jpg.dll
1⤵
PID:748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-60-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Filesize
8KB

Download
memory/748-61-0x0000000001E60000-0x000000000210A000-memory.dmp

Filesize
2.7MB

Download