Resubmissions
24-08-2021 15:46
210824-t6hzlqqj4a 1024-08-2021 15:30
210824-gm7skbgnee 1024-08-2021 15:27
210824-68px7xses6 1024-08-2021 15:17
210824-2783vynafn 1004-08-2021 16:51
210804-8pmmxqpdzn 10Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-08-2021 16:51
Static task
static1
Behavioral task
behavioral1
Sample
JVrLyRD.dat.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
JVrLyRD.dat.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
JVrLyRD.dat.dll
-
Size
242KB
-
MD5
12e60d21fd9c8675368635ea5246e393
-
SHA1
60ae64cd005f862797279fb151c9a0433b8e654c
-
SHA256
70c2422033dd395c0a6c15b5e6dbdde34aa65b7481d4b8298e70e0c3e72a2182
-
SHA512
6509c404b274af6250a241b441558d010729da12bbad47dd59c2da5a7480f682ff8c5bfeace9b2bc65db22f212b6399cd74f3f25ae22354db0ca8e06d85ed189
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 3 IoCs
resource yara_rule behavioral1/memory/784-62-0x00000000FF6E4580-mapping.dmp BazarBackdoorVar4 behavioral1/memory/784-61-0x00000000FF6C0000-0x00000000FF711000-memory.dmp BazarBackdoorVar4 behavioral1/memory/784-65-0x00000000FF6C0000-0x00000000FF711000-memory.dmp BazarBackdoorVar4 -
Bazar/Team9 Loader payload 1 IoCs
resource yara_rule behavioral1/memory/1756-60-0x0000000001E60000-0x0000000001FF7000-memory.dmp BazarLoaderVar6 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1756 set thread context of 784 1756 regsvr32.exe 30 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1756 regsvr32.exe 1756 regsvr32.exe 1756 regsvr32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30 PID 1756 wrote to memory of 784 1756 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\JVrLyRD.dat.dll1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup2⤵PID:784
-