bazarbackdoor | 06901137edd64860bb15102bfd9e2a7c85c3a38517511883ccd8db6eebd8ae9f

General

Target

9dcbff0945ffba2e5e8b4dc03dd89f85346d9919c7084bed59671a003bd1eb86.dll
Size

142KB
MD5

95ac6fda2d58ac5de7fd19220443e808
SHA1

666d8b10f5b39aec23bb67d7f03288c8dbcd45d8
SHA256

9dcbff0945ffba2e5e8b4dc03dd89f85346d9919c7084bed59671a003bd1eb86
SHA512

3db7c4e7ea8338b99e1c38a7cb00c838cce734ae614342bb69aa43f89215ce05ed09461e62bf2b3d89bd5472b0559a9105b8a6a4216dd19d26ea190e4aa7931c

Score

10^/10

bazarbackdoor bazarloader backdoor dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2416-116-0x00007FF7EA0844E0-mapping.dmp	BazarBackdoorVar4
behavioral2/memory/2416-115-0x00007FF7EA060000-0x00007FF7EA0B1000-memory.dmp	BazarBackdoorVar4
behavioral2/memory/2416-117-0x00007FF7EA060000-0x00007FF7EA0B1000-memory.dmp	BazarBackdoorVar4

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1096-114-0x0000017B51C90000-0x0000017B51D6C000-memory.dmp	BazarLoaderVar6
behavioral2/memory/1492-118-0x0000017447430000-0x000001744750C000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

11 1096 rundll32.exe
13 1096 rundll32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1096 set thread context of 2416 1096 rundll32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

1096 rundll32.exe
1096 rundll32.exe
1096 rundll32.exe
1096 rundll32.exe
1096 rundll32.exe
1096 rundll32.exe

flow	pid	process
11	1096	rundll32.exe
13	1096	rundll32.exe

description	pid	process	target process
PID 1096 set thread context of 2416	1096	rundll32.exe	svchost.exe

pid	process
1096	rundll32.exe
1096	rundll32.exe
1096	rundll32.exe
1096	rundll32.exe
1096	rundll32.exe
1096	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe
PID 1096 wrote to memory of 2416	1096	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9dcbff0945ffba2e5e8b4dc03dd89f85346d9919c7084bed59671a003bd1eb86.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
2⤵
PID:2416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\9dcbff0945ffba2e5e8b4dc03dd89f85346d9919c7084bed59671a003bd1eb86.dll,#1 3593333632
1⤵
PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-114-0x0000017B51C90000-0x0000017B51D6C000-memory.dmp

Filesize
880KB

Download
memory/1492-118-0x0000017447430000-0x000001744750C000-memory.dmp

Filesize
880KB

Download
memory/2416-116-0x00007FF7EA0844E0-mapping.dmp

Download
memory/2416-115-0x00007FF7EA060000-0x00007FF7EA0B1000-memory.dmp

Filesize
324KB

Download
memory/2416-117-0x00007FF7EA060000-0x00007FF7EA0B1000-memory.dmp

Filesize
324KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads