Analysis
-
max time kernel
133s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 14:54
Static task
static1
Behavioral task
behavioral1
Sample
iCoreBr.jpg.dll
Resource
win7v20210408
Behavioral task
behavioral2
Sample
iCoreBr.jpg.dll
Resource
win10v20210408
General
-
Target
iCoreBr.jpg.dll
-
Size
1.3MB
-
MD5
132e6560ca121679635684e812586bba
-
SHA1
6f48b7929e65aac27f3bf3cce24c7ad40624dc74
-
SHA256
c882f778e40b276c90d467816deda7605d9955e4302aa6ab7467aeae3f155048
-
SHA512
3c3fd439c29e36a2ef174f82c4df36c89a87bbc2e280753166bc25b14b6066fc6b0eff7101e4b301e51722271b76ebdb79dbf58a201a7a4c8bcb64e708e6a4a5
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4648-118-0x0000000027E90000-0x0000000027EF4000-memory.dmp BazarLoaderVar3 behavioral2/memory/4296-126-0x00000000278F0000-0x0000000027954000-memory.dmp BazarLoaderVar3 behavioral2/memory/1692-139-0x0000000028340000-0x00000000283A4000-memory.dmp BazarLoaderVar3 -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1692 regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\RealtechUpdate = "\"C:\\Windows\\system32\\regsvr32.exe\" /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Damp\\coianewos.exe\" mscp arih" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 4296 regsvr32.exe 4296 regsvr32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
regsvr32.execmd.exeregsvr32.execmd.execmd.exedescription pid process target process PID 4648 wrote to memory of 4036 4648 regsvr32.exe cmd.exe PID 4648 wrote to memory of 4036 4648 regsvr32.exe cmd.exe PID 4036 wrote to memory of 4264 4036 cmd.exe PING.EXE PID 4036 wrote to memory of 4264 4036 cmd.exe PING.EXE PID 4036 wrote to memory of 4296 4036 cmd.exe regsvr32.exe PID 4036 wrote to memory of 4296 4036 cmd.exe regsvr32.exe PID 4296 wrote to memory of 668 4296 regsvr32.exe cmd.exe PID 4296 wrote to memory of 668 4296 regsvr32.exe cmd.exe PID 4296 wrote to memory of 64 4296 regsvr32.exe cmd.exe PID 4296 wrote to memory of 64 4296 regsvr32.exe cmd.exe PID 4296 wrote to memory of 584 4296 regsvr32.exe cmd.exe PID 4296 wrote to memory of 584 4296 regsvr32.exe cmd.exe PID 584 wrote to memory of 1432 584 cmd.exe PING.EXE PID 584 wrote to memory of 1432 584 cmd.exe PING.EXE PID 64 wrote to memory of 1496 64 cmd.exe reg.exe PID 64 wrote to memory of 1496 64 cmd.exe reg.exe PID 584 wrote to memory of 1692 584 cmd.exe regsvr32.exe PID 584 wrote to memory of 1692 584 cmd.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\iCoreBr.jpg.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ping 127.0.0.1 -n 8 & "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\iCoreBr.jpg.dll" mscp ahis & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 83⤵
- Runs ping.exe
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\iCoreBr.jpg.dll" mscp ahis3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c echo %temp%4⤵
-
C:\Windows\system32\cmd.execmd.exe /c reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v RealtechUpdate /t REG_SZ /d "\"C:\Windows\system32\regsvr32.exe\" /s \"C:\Users\Admin\AppData\Local\Temp\Damp\coianewos.exe\" mscp arih"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v RealtechUpdate /t REG_SZ /d "\"C:\Windows\system32\regsvr32.exe\" /s \"C:\Users\Admin\AppData\Local\Temp\Damp\coianewos.exe\" mscp arih"5⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\system32\cmd.execmd /c ping 127.0.0.1 -n 8 & "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\Damp\coianewos.exe" mscp arih & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 85⤵
- Runs ping.exe
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\Damp\coianewos.exe" mscp arih5⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Damp\coianewos.exeMD5
132e6560ca121679635684e812586bba
SHA16f48b7929e65aac27f3bf3cce24c7ad40624dc74
SHA256c882f778e40b276c90d467816deda7605d9955e4302aa6ab7467aeae3f155048
SHA5123c3fd439c29e36a2ef174f82c4df36c89a87bbc2e280753166bc25b14b6066fc6b0eff7101e4b301e51722271b76ebdb79dbf58a201a7a4c8bcb64e708e6a4a5
-
\Users\Admin\AppData\Local\Temp\Damp\coianewos.exeMD5
132e6560ca121679635684e812586bba
SHA16f48b7929e65aac27f3bf3cce24c7ad40624dc74
SHA256c882f778e40b276c90d467816deda7605d9955e4302aa6ab7467aeae3f155048
SHA5123c3fd439c29e36a2ef174f82c4df36c89a87bbc2e280753166bc25b14b6066fc6b0eff7101e4b301e51722271b76ebdb79dbf58a201a7a4c8bcb64e708e6a4a5
-
memory/64-128-0x0000000000000000-mapping.dmp
-
memory/584-129-0x0000000000000000-mapping.dmp
-
memory/668-127-0x0000000000000000-mapping.dmp
-
memory/1432-130-0x0000000000000000-mapping.dmp
-
memory/1496-131-0x0000000000000000-mapping.dmp
-
memory/1692-132-0x0000000000000000-mapping.dmp
-
memory/1692-139-0x0000000028340000-0x00000000283A4000-memory.dmpFilesize
400KB
-
memory/4036-119-0x0000000000000000-mapping.dmp
-
memory/4264-120-0x0000000000000000-mapping.dmp
-
memory/4296-126-0x00000000278F0000-0x0000000027954000-memory.dmpFilesize
400KB
-
memory/4296-121-0x0000000000000000-mapping.dmp
-
memory/4648-118-0x0000000027E90000-0x0000000027EF4000-memory.dmpFilesize
400KB
-
memory/4648-115-0x0000000000E40000-0x0000000000E42000-memory.dmpFilesize
8KB
-
memory/4648-117-0x0000000000E40000-0x0000000000E42000-memory.dmpFilesize
8KB
-
memory/4648-116-0x0000000000E40000-0x0000000000E42000-memory.dmpFilesize
8KB