bazarloader | 47bac27be954cf593ac731cd57fa98b565cf5036a6fbf35c508549f039eea8f3

General

Target

TIMECLOCK.exe
Size

460KB
MD5

513b43a30628978d52d18912b72dcdd0
SHA1

97368003849122e99dc7b0e25b4b37b2999053ee
SHA256

47bac27be954cf593ac731cd57fa98b565cf5036a6fbf35c508549f039eea8f3
SHA512

a8e846109b644df3e905e33ae2218b5f0c7f65efd2a202c2d2c38a89d2e979d4379862b545523b7338855f51f087ad4d7c41746197e9f233e938ed4bbfbb5c0c

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/996-114-0x00000000023C0000-0x00000000023D4000-memory.dmp	BazarLoaderVar1
behavioral1/memory/996-117-0x00000000023E0000-0x00000000023F6000-memory.dmp	BazarLoaderVar1
behavioral1/memory/996-120-0x00000000023A0000-0x00000000023B2000-memory.dmp	BazarLoaderVar1
behavioral1/memory/2084-121-0x0000000002180000-0x0000000002194000-memory.dmp	BazarLoaderVar1
behavioral1/memory/2084-124-0x00000000021A0000-0x00000000021B6000-memory.dmp	BazarLoaderVar1

Blocklisted process makes network request 8 IoCs

Processes:

cmd.exe

flow pid process

20 2748 cmd.exe
27 2748 cmd.exe
30 2748 cmd.exe
31 2748 cmd.exe
32 2748 cmd.exe
33 2748 cmd.exe
34 2748 cmd.exe
35 2748 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

TIMECLOCK.exe

description pid process target process

PID 996 set thread context of 2748 996 TIMECLOCK.exe cmd.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

TIMECLOCK.exeTIMECLOCK.exe

pid process

996 TIMECLOCK.exe
996 TIMECLOCK.exe
2084 TIMECLOCK.exe
2084 TIMECLOCK.exe

flow	pid	process
20	2748	cmd.exe
27	2748	cmd.exe
30	2748	cmd.exe
31	2748	cmd.exe
32	2748	cmd.exe
33	2748	cmd.exe
34	2748	cmd.exe
35	2748	cmd.exe

description	pid	process	target process
PID 996 set thread context of 2748	996	TIMECLOCK.exe	cmd.exe

pid	process
996	TIMECLOCK.exe
996	TIMECLOCK.exe
2084	TIMECLOCK.exe
2084	TIMECLOCK.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

TIMECLOCK.exe

description	pid	process	target process
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe
PID 996 wrote to memory of 2748	996	TIMECLOCK.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\TIMECLOCK.exe
"C:\Users\Admin\AppData\Local\Temp\TIMECLOCK.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\cmd.exe
C:\Windows\System32\cmd.exe
2⤵
- Blocklisted process makes network request
PID:2748

C:\Users\Admin\AppData\Local\Temp\TIMECLOCK.exe
C:\Users\Admin\AppData\Local\Temp\TIMECLOCK.exe {436805BE-460E-422E-B39A-3662EDDE0573}
1⤵
- Suspicious use of SetWindowsHookEx
PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DRMDU4BX\vACTH0kTwC[1]
MD5
ba30004f9864a7c1d22963da098ae937

SHA1
a2281da007709cfa6117a3cb8386be1fd810502e

SHA256
51a3fbc42187965a2ca26b16514e8dc39f97ea8f8429ea437ef31bc308fc8d35

SHA512
58596d7e0965e6fb16f629ef248affdf6232fd56e06e632eeba52c1e1b7c5cbf85ba00f1944ec0f55d6f0d4df8e784f6e04f42944736fd988dabce9a68e57caa

Download Submit
memory/996-114-0x00000000023C0000-0x00000000023D4000-memory.dmp

Filesize
80KB

Download
memory/996-117-0x00000000023E0000-0x00000000023F6000-memory.dmp

Filesize
88KB

Download
memory/996-120-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/2084-121-0x0000000002180000-0x0000000002194000-memory.dmp

Filesize
80KB

Download
memory/2084-124-0x00000000021A0000-0x00000000021B6000-memory.dmp

Filesize
88KB

Download
memory/2748-127-0x0000000000E00000-0x0000000000E43000-memory.dmp

Filesize
268KB

Download
memory/2748-128-0x0000000000E24525-mapping.dmp

Download
memory/2748-129-0x0000000000E00000-0x0000000000E43000-memory.dmp

Filesize
268KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads