bazarbackdoor | 70c2422033dd395c0a6c15b5e6dbdde34aa65b7481d4b8298e70e0c3e72a2182

Target

JVrLyRD.dat.dll
Size

242KB
MD5

12e60d21fd9c8675368635ea5246e393
SHA1

60ae64cd005f862797279fb151c9a0433b8e654c
SHA256

70c2422033dd395c0a6c15b5e6dbdde34aa65b7481d4b8298e70e0c3e72a2182
SHA512

6509c404b274af6250a241b441558d010729da12bbad47dd59c2da5a7480f682ff8c5bfeace9b2bc65db22f212b6399cd74f3f25ae22354db0ca8e06d85ed189

Score

10^/10

bazarbackdoor bazarloader backdoor dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2340-115-0x00007FF6560E0000-0x00007FF656131000-memory.dmp	BazarBackdoorVar4
behavioral2/memory/2340-116-0x00007FF656104580-mapping.dmp	BazarBackdoorVar4
behavioral2/memory/2340-117-0x00007FF6560E0000-0x00007FF656131000-memory.dmp	BazarBackdoorVar4

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/808-114-0x00000000024C0000-0x0000000002657000-memory.dmp	BazarLoaderVar6

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 808 set thread context of 2340 808 regsvr32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exe

pid process

808 regsvr32.exe
808 regsvr32.exe
808 regsvr32.exe
808 regsvr32.exe
808 regsvr32.exe
808 regsvr32.exe

description	pid	process	target process
PID 808 set thread context of 2340	808	regsvr32.exe	svchost.exe

pid	process
808	regsvr32.exe
808	regsvr32.exe
808	regsvr32.exe
808	regsvr32.exe
808	regsvr32.exe
808	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe
PID 808 wrote to memory of 2340	808	regsvr32.exe	svchost.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JVrLyRD.dat.dll
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
2⤵
PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-114-0x00000000024C0000-0x0000000002657000-memory.dmp

Filesize
1.6MB

Download
memory/2340-115-0x00007FF6560E0000-0x00007FF656131000-memory.dmp

Filesize
324KB

Download
memory/2340-116-0x00007FF656104580-mapping.dmp

Download
memory/2340-117-0x00007FF6560E0000-0x00007FF656131000-memory.dmp

Filesize
324KB

Download