Analysis
- max time kernel
97s - max time network
114s - platform
windows10_x64 - resource
win10v20210408 - submitted
29/07/2021, 16:13
Static task
static1
Behavioral task
behavioral1
Sample
vWJpojwO.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
vWJpojwO.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target vWJpojwO.dll
- Size 494KB
- Sample210729-wp4mbab14a
- SHA256 986d22f03f04424181bc773a42db6283722baffe40b031d97c9562ab0ed8a6ae
- MD5 d68207a53432cdab35cc3692b385f065
- SHA1 6037567a44fc6fd5e44519ab6a205ac53ba97fff
- SHA512 71dd3fc2d39bca744231a8b47b261dfd2a4953d8607cf584383c360cd9f0f8b2d95dee38955a0562e111bf3140e6f380ae8f1675cd2648d778d366bc9f337a76
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
- suricata: ET MALWARE Observed Malicious SSL Cert (BazaLoader CnC)
- suricata: ET MALWARE Observed Malicious SSL Cert (Bazar Backdoor)
- Bazar/Team9 Backdoor payload 3 IoCs
resource yara_rule behavioral2/memory/2640-122-0x00007FF7D6A40000-0x00007FF7D6A91000-memory.dmp BazarBackdoorVar4 behavioral2/memory/2640-123-0x00007FF7D6A642E0-mapping.dmp BazarBackdoorVar4 behavioral2/memory/2640-124-0x00007FF7D6A40000-0x00007FF7D6A91000-memory.dmp BazarBackdoorVar4 - Blocklisted process makes network request 2 IoCs
flow pid Process 11 804 rundll32.exe 13 804 rundll32.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 804 set thread context of 2640 804 rundll32.exe 79 - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 804 rundll32.exe 804 rundll32.exe 804 rundll32.exe 804 rundll32.exe 804 rundll32.exe 804 rundll32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79 PID 804 wrote to memory of 2640 804 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\vWJpojwO.dll,#11⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup2⤵PID:2640
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\vWJpojwO.dll,#1 22465097521⤵PID:512