738f4267728385be1d6336685338a0af96f09587218dbc6b3b88db07d1326877 | Triage

Analysis

max time kernel
91s
max time network
139s
platform
windows10_x64
resource
win10v20210408
submitted
21-07-2021 14:22

Sharing

Report Analysis Logs

General

Target

boysLove.jpg.dll
Size

454KB
MD5

a54bf8f8470245c908cc1de6063e04fc
SHA1

a02f9a05c2fb54d898b71da065e87501ab60828c
SHA256

738f4267728385be1d6336685338a0af96f09587218dbc6b3b88db07d1326877
SHA512

1905141e3000aa2296fff83e0d2f576a7b8e5f3ef26bd884476aa38bc4dbc53e61dc0c9a0f31a9e0d320d932758b2da43cb4e6986607000ffdebd83ec0244680

Score

8^/10

Malware Config

Signatures

Tries to connect to .bazar domain 36 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
35	greencloud46a.bazar
46	whitestorm9p.bazar
54	yellowdownpour81.bazar
31	greencloud46a.bazar
33	greencloud46a.bazar
34	greencloud46a.bazar
36	greencloud46a.bazar
37	greencloud46a.bazar
42	whitestorm9p.bazar
43	whitestorm9p.bazar
47	whitestorm9p.bazar
55	yellowdownpour81.bazar
58	yellowdownpour81.bazar
60	yellowdownpour81.bazar
62	yellowdownpour81.bazar
44	whitestorm9p.bazar
52	yellowdownpour81.bazar
53	yellowdownpour81.bazar
39	whitestorm9p.bazar
59	yellowdownpour81.bazar
40	whitestorm9p.bazar
41	whitestorm9p.bazar
48	whitestorm9p.bazar
56	yellowdownpour81.bazar
29	greencloud46a.bazar
30	greencloud46a.bazar
32	greencloud46a.bazar
45	whitestorm9p.bazar
49	whitestorm9p.bazar
27	greencloud46a.bazar
28	greencloud46a.bazar
38	greencloud46a.bazar
50	whitestorm9p.bazar
51	yellowdownpour81.bazar
57	yellowdownpour81.bazar
61	yellowdownpour81.bazar

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description flow ioc

HTTP URL 20 https://api.opennicproject.org/geoip/?bare&ipv=4

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\boysLove.jpg.dll
1⤵
PID:656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-114-0x0000000002C90000-0x0000000002F3A000-memory.dmp

Filesize
2.7MB

Download