Overview

overview

10

Static

static

DialogGL.EXE

windows7_x64

10

Resubmissions

16/03/2022, 10:58 UTC

220316-m219ascgd6 10

16/09/2021, 14:03 UTC

210916-rc1npagdel 10

15/09/2021, 23:08 UTC

210915-24mw1sbeb5 1

Analysis

  • max time kernel
    481s
  • max time network
    517s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    16/09/2021, 14:03 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DialogGL.EXE

  • Size

    224KB

  • MD5

    3e494cf9a64f6836638f8f99d4015d5b

  • SHA1

    de1d042453c77ba66bb9993c40245fd493fcb679

  • SHA256

    1625a3baefca74d244796f8ba85972350fda0994cf6752ac4d8ea8ff93052f42

  • SHA512

    e2db480175db189de53d35fe6a2318f9ccafec0ca709efa35d38444f52ab1a4db60a7ce9f4414131ee478dd262c50d904eec5eaf6fbd98b2ca2e95c590c89dee

Score
10/10
bazarloaderdropperloader

Malware Config

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Bazar/Team9 Loader payload 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DialogGL.EXE
    "C:\Users\Admin\AppData\Local\Temp\DialogGL.EXE"
    1⤵
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    PID:2028
  • C:\Users\Admin\AppData\Local\Temp\DialogGL.EXE
    C:\Users\Admin\AppData\Local\Temp\DialogGL.EXE {BD100145-C8FC-4B71-A3C6-375065B332A4}
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1808

Network

  • flag-us
    DNS
    microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    microsoft.com
    IN A
    Response
    microsoft.com
    IN A
    104.215.148.63
    microsoft.com
    IN A
    40.76.4.15
    microsoft.com
    IN A
    40.112.72.205
    microsoft.com
    IN A
    40.113.200.201
    microsoft.com
    IN A
    13.77.161.179
  • flag-us
    GET
    https://107.173.192.166/engines/handle
    DialogGL.EXE
    Remote address:
    107.173.192.166:443
    Request
    GET /engines/handle HTTP/1.1
    Date: Thursday, 16 September 2021
    Cookie: ANID=NWqEJnhzyDbrJQrdg282uQqIJsvXoDQiOXOAJhp49%2BAYwsxIKccGPVMcetHQz%2FNqmHQXdb2kaECvhwMEnXHlyV717vkFMtrgWyfjjGFAGKZEKEtOoH5AHhGFtdRCsK5qZyJ9pYkDCsdAemYwpHe47Fsr4JzIq2UFynFGCNJnV9TIJ7MgOPCWvXZcSmG5%2Fbu%2BWfZu12H5yZzpWq%2BjMcFk2hEb2oniuIQwTXR0wNI0qvpW76q5akPIHIIQbazUOhrV3bLovNWqOA%2FJ4IWittPo%2BVyKKS%2BYi9dj7INJLy5fjvX8BWxf8IlF4NDDo5WNi2AvoHZEbqk%2BVqXU6e8FJQP5NA%3D%3D;
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
    Host: 107.173.192.166
    Response
    HTTP/1.1 502 Bad Gateway
    Server: nginx/1.14.2
    Date: Thu, 16 Sep 2021 14:06:13 GMT
    Content-Type: text/html
    Content-Length: 575
    Connection: keep-alive
  • flag-nl
    GET
    https://64.227.72.83/engines/handle
    DialogGL.EXE
    Remote address:
    64.227.72.83:443
    Request
    GET /engines/handle HTTP/1.1
    Date: Thursday, 16 September 2021
    Cookie: ANID=NWqEJnhzyDbrJQrdg282uQqIJsvXoDQiOXOAJhp49%2BAYwsxIKccGPVMcetHQz%2FNqmHQXdb2kaECvhwMEnXHlyV717vkFMtrgWyfjjGFAGKZEKEtOoH5AHhGFtdRCsK5qZyJ9pYkDCsdAemYwpHe47Fsr4JzIq2UFynFGCNJnV9TIJ7MgOPCWvXZcSmG5%2Fbu%2BWfZu12H5yZzpWq%2BjMcFk2hEb2oniuIQwTXR0wNI0qvpW76q5akPIHIIQbazUOhrV3bLovNWqOA%2FJ4IWittPo%2BVyKKS%2BYi9dj7INJLy5fjvX8BWxf8IlF4NDDo5WNi2AvoHZEbqk%2BVqXU6e8FJQP5NA%3D%3D;
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
    Host: 64.227.72.83
    Response
    HTTP/1.1 502 Bad Gateway
    Server: nginx/1.18.0 (Ubuntu)
    Date: Thu, 16 Sep 2021 14:06:18 GMT
    Content-Type: text/html
    Content-Length: 568
    Connection: keep-alive
  • flag-cz
    GET
    https://194.15.112.159/engines/handle
    DialogGL.EXE
    Remote address:
    194.15.112.159:443
    Request
    GET /engines/handle HTTP/1.1
    Date: Thursday, 16 September 2021
    Cookie: ANID=NWqEJnhzyDbrJQrdg282uQqIJsvXoDQiOXOAJhp49%2BAYwsxIKccGPVMcetHQz%2FNqmHQXdb2kaECvhwMEnXHlyV717vkFMtrgWyfjjGFAGKZEKEtOoH5AHhGFtdRCsK5qZyJ9pYkDCsdAemYwpHe47Fsr4JzIq2UFynFGCNJnV9TIJ7MgOPCWvXZcSmG5%2Fbu%2BWfZu12H5yZzpWq%2BjMcFk2hEb2oniuIQwTXR0wNI0qvpW76q5akPIHIIQbazUOhrV3bLovNWqOA%2FJ4IWittPo%2BVyKKS%2BYi9dj7INJLy5fjvX8BWxf8IlF4NDDo5WNi2AvoHZEbqk%2BVqXU6e8FJQP5NA%3D%3D;
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
    Host: 194.15.112.159
    Response
    HTTP/1.1 502 Bad Gateway
    Server: nginx/1.14.2
    Date: Thu, 16 Sep 2021 14:06:22 GMT
    Content-Type: text/html
    Content-Length: 575
    Connection: keep-alive
  • flag-nl
    GET
    https://64.225.67.166/engines/handle
    DialogGL.EXE
    Remote address:
    64.225.67.166:443
    Request
    GET /engines/handle HTTP/1.1
    Date: Thursday, 16 September 2021
    Cookie: ANID=NWqEJnhzyDbrJQrdg282uQqIJsvXoDQiOXOAJhp49%2BAYwsxIKccGPVMcetHQz%2FNqmHQXdb2kaECvhwMEnXHlyV717vkFMtrgWyfjjGFAGKZEKEtOoH5AHhGFtdRCsK5qZyJ9pYkDCsdAemYwpHe47Fsr4JzIq2UFynFGCNJnV9TIJ7MgOPCWvXZcSmG5%2Fbu%2BWfZu12H5yZzpWq%2BjMcFk2hEb2oniuIQwTXR0wNI0qvpW76q5akPIHIIQbazUOhrV3bLovNWqOA%2FJ4IWittPo%2BVyKKS%2BYi9dj7INJLy5fjvX8BWxf8IlF4NDDo5WNi2AvoHZEbqk%2BVqXU6e8FJQP5NA%3D%3D;
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
    Host: 64.225.67.166
    Response
    HTTP/1.1 502 Bad Gateway
    Server: nginx/1.18.0 (Ubuntu)
    Date: Thu, 16 Sep 2021 14:06:27 GMT
    Content-Type: text/html
    Content-Length: 568
    Connection: keep-alive
  • flag-us
    DNS
    api.opennicproject.org
    DialogGL.EXE
    Remote address:
    8.8.8.8:53
    Request
    api.opennicproject.org
    IN A
    Response
    api.opennicproject.org
    IN CNAME
    api.opennic.org
    api.opennic.org
    IN A
    116.203.98.109
  • flag-de
    GET
    https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8
    DialogGL.EXE
    Remote address:
    116.203.98.109:443
    Request
    GET /geoip/?bare&ipv=4&wl=all&res=8 HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
    Host: api.opennicproject.org
  • 104.215.148.63:443
    microsoft.com
    tls
    301 B
     179 B
     4
    4
  • 104.215.148.63:443
    microsoft.com
    tls
    242 B
     179 B
     4
    4
  • 107.173.192.166:443
    https://107.173.192.166/engines/handle
    tls, http
    DialogGL.EXE
    1.6kB
     3.0kB
     15
    15

    HTTP Request

    GET https://107.173.192.166/engines/handle

    HTTP Response

    502
  • 64.227.72.83:443
    https://64.227.72.83/engines/handle
    tls, http
    DialogGL.EXE
    1.7kB
     3.1kB
     15
    16

    HTTP Request

    GET https://64.227.72.83/engines/handle

    HTTP Response

    502
  • 194.15.112.159:443
    https://194.15.112.159/engines/handle
    tls, http
    DialogGL.EXE
    1.7kB
     3.1kB
     15
    16

    HTTP Request

    GET https://194.15.112.159/engines/handle

    HTTP Response

    502
  • 64.225.67.166:443
    https://64.225.67.166/engines/handle
    tls, http
    DialogGL.EXE
    1.6kB
     4.0kB
     14
    17

    HTTP Request

    GET https://64.225.67.166/engines/handle

    HTTP Response

    502
  • 116.203.98.109:443
    https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8
    tls, http
    DialogGL.EXE
    1.2kB
     5.3kB
     8
    11

    HTTP Request

    GET https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8
  • 8.8.8.8:53
    microsoft.com
    dns
    59 B
     139 B
     1
    1

    DNS Request

    microsoft.com

    DNS Response

    104.215.148.63
    40.76.4.15
    40.112.72.205
    40.113.200.201
    13.77.161.179

  • 8.8.8.8:53
    api.opennicproject.org
    dns
    DialogGL.EXE
    68 B
     110 B
     1
    1

    DNS Request

    api.opennicproject.org

    DNS Response

    116.203.98.109

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1808-72-0x0000000001D80000-0x0000000001D96000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2028-60-0x00000000762C1000-0x00000000762C3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2028-61-0x00000000003D0000-0x00000000003E4000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2028-64-0x0000000000440000-0x0000000000456000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2028-67-0x00000000003B0000-0x00000000003C1000-memory.dmp

    Filesize

    68KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.