bazarbackdoor | 8d9a5a1713cf71f93f7a79045d329f690233df1273e2eba1e9f0dc6dae28411a

General

Target

diretto_09.21.doc
Size

131KB
MD5

b00b548fde0aed1436f7ec6f9a87b007
SHA1

6a54bc7bc4f8a7c6747e26733482bda28d8e3054
SHA256

8d9a5a1713cf71f93f7a79045d329f690233df1273e2eba1e9f0dc6dae28411a
SHA512

3003ec06428c49459a79f6a78322ff3d10a5cab499ed1897a78ebdf052b1bd289518c8d89c21e2171cfeec6c46203cdfbe63aef444f34522124647f38cba0aa6

Score

10^/10

bazarbackdoor bazarloader backdoor dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	488	1572	mshta.exe	WINWORD.EXE

Bazar/Team9 Backdoor payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4380-375-0x00007FF7F46A0000-0x00007FF7F46ED000-memory.dmp	BazarBackdoorVar4
behavioral2/memory/4380-376-0x00007FF7F46C66F0-mapping.dmp	BazarBackdoorVar4
behavioral2/memory/4380-377-0x00007FF7F46A0000-0x00007FF7F46ED000-memory.dmp	BazarBackdoorVar4

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2372-303-0x00000000025D0000-0x00000000025E7000-memory.dmp	BazarLoaderVar6
behavioral2/memory/4228-307-0x00000166C2B20000-0x00000166C2B37000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

8 488 mshta.exe
Downloads MZ/PE file

flow	pid	process
8	488	mshta.exe

Tries to connect to .bazar domain 14 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
58	bluehail.bazar
68	qegouhed.bazar
72	omkywyyw.bazar
76	tonuidem.bazar
56	blackrain15.bazar
77	tonuidem.bazar
81	ewxuwyed.bazar
89	ibokuhem.bazar
57	reddew28c.bazar
64	onroekem.bazar
55	blackrain15.bazar
59	whitestorm9p.bazar
60	emxiuhyw.bazar
85	edanekyw.bazar

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exeregsvr32.exerundll32.exe

pid process

2164 regsvr32.exe
2372 regsvr32.exe
4228 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description flow ioc

HTTP URL 54 https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8
Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 2372 set thread context of 4380 2372 regsvr32.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2164	regsvr32.exe
2372	regsvr32.exe
4228	rundll32.exe

description	flow	ioc
HTTP URL	54	https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8

description	pid	process	target process
PID 2372 set thread context of 4380	2372	regsvr32.exe	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1572 WINWORD.EXE
1572 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exe

pid process

2372 regsvr32.exe
2372 regsvr32.exe
2372 regsvr32.exe
2372 regsvr32.exe
2372 regsvr32.exe
2372 regsvr32.exe
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

WINWORD.EXE

pid process

1572 WINWORD.EXE
1572 WINWORD.EXE
1572 WINWORD.EXE
1572 WINWORD.EXE
1572 WINWORD.EXE
1572 WINWORD.EXE
1572 WINWORD.EXE
1572 WINWORD.EXE
1572 WINWORD.EXE

pid	process
1572	WINWORD.EXE
1572	WINWORD.EXE

pid	process
2372	regsvr32.exe
2372	regsvr32.exe
2372	regsvr32.exe
2372	regsvr32.exe
2372	regsvr32.exe
2372	regsvr32.exe

pid	process
1572	WINWORD.EXE
1572	WINWORD.EXE
1572	WINWORD.EXE
1572	WINWORD.EXE
1572	WINWORD.EXE
1572	WINWORD.EXE
1572	WINWORD.EXE
1572	WINWORD.EXE
1572	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WINWORD.EXEmshta.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1572 wrote to memory of 488	1572	WINWORD.EXE	mshta.exe
PID 1572 wrote to memory of 488	1572	WINWORD.EXE	mshta.exe
PID 1572 wrote to memory of 488	1572	WINWORD.EXE	mshta.exe
PID 488 wrote to memory of 2164	488	mshta.exe	regsvr32.exe
PID 488 wrote to memory of 2164	488	mshta.exe	regsvr32.exe
PID 488 wrote to memory of 2164	488	mshta.exe	regsvr32.exe
PID 2164 wrote to memory of 2372	2164	regsvr32.exe	regsvr32.exe
PID 2164 wrote to memory of 2372	2164	regsvr32.exe	regsvr32.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe
PID 2372 wrote to memory of 4380	2372	regsvr32.exe	svchost.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\diretto_09.21.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\aprilAccessWindows...hTa" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" c:\users\public\aprilAccessWindows.jpg
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\system32\regsvr32.exe
      c:\users\public\aprilAccessWindows.jpg
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2372
    - - C:\Windows\system32\svchost.exe
        
        C:\Windows\system32\svchost.exe -k UnistackSvcGroup
        5⤵
        
        PID:4380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe c:\users\public\aprilAccessWindows.jpg,DllRegisterServer {4B75876C-2E2F-4397-915A-B9BD92E5145B}
1⤵
- Loads dropped DLL
PID:4228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HBPS4WXS\DjDS7eJx9H[1]

MD5
fe7fd41dc1885f52d80f926ca71760c7

SHA1
73d69097914f45ad6c0b2d97c3e23587bfbbd15c

SHA256
4a220413e30e4d47e82583fea0aaa4935b258bfa06eb6f0db42bb78622c53974

SHA512
c8593f3b59dbcbc4788f57517d4fd61669ed8a44cdf69cf45a69400d1cc3ebfd3c93055d077618a6de4d75cbb743bdbb008ddb73d9e1061d2238719a4f5d1b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\aprilAccessWindows...hTa

MD5
a7297781b5aecf4513d5a7a866e6281a

SHA1
a2c2d1365a122bd28b23426db3807ca712bc354a

SHA256
96d5aaa8342c344fdae21fe8fc414bed055f075435129e9e81d77667be7bb946

SHA512
09b297ecf0dbc561d3e8b249ce3bfacb1a17000e507caf116778656b665262a8144a2190f844c087f7e4ce357f656888c5e6867650739ebcd51b91330a6248d2

Download Submit
\??\c:\users\public\aprilAccessWindows.jpg

MD5
be6439d9ceb8b19a8b4a2343a7936118

SHA1
85d5955240434cc8fed1fd433c7085f4efa33134

SHA256
f524fe9e250c6a0159ebbad3ab06b13be1d0cbd544e21997f81b9d3ec195e6ab

SHA512
25530b160f00691ff00e0264a4cdc84b2285afb8d614d7b6acb21f9203a8a3dc724549cd5ec239d74145b0607227c7c1d7e8cc24fa88dd190f3e0932f84bc5ac

Download Submit
\Users\Public\aprilAccessWindows.jpg

MD5
be6439d9ceb8b19a8b4a2343a7936118

SHA1
85d5955240434cc8fed1fd433c7085f4efa33134

SHA256
f524fe9e250c6a0159ebbad3ab06b13be1d0cbd544e21997f81b9d3ec195e6ab

SHA512
25530b160f00691ff00e0264a4cdc84b2285afb8d614d7b6acb21f9203a8a3dc724549cd5ec239d74145b0607227c7c1d7e8cc24fa88dd190f3e0932f84bc5ac

Download Submit
\Users\Public\aprilAccessWindows.jpg

MD5
be6439d9ceb8b19a8b4a2343a7936118

SHA1
85d5955240434cc8fed1fd433c7085f4efa33134

SHA256
f524fe9e250c6a0159ebbad3ab06b13be1d0cbd544e21997f81b9d3ec195e6ab

SHA512
25530b160f00691ff00e0264a4cdc84b2285afb8d614d7b6acb21f9203a8a3dc724549cd5ec239d74145b0607227c7c1d7e8cc24fa88dd190f3e0932f84bc5ac

Download Submit
\Users\Public\aprilAccessWindows.jpg

MD5
be6439d9ceb8b19a8b4a2343a7936118

SHA1
85d5955240434cc8fed1fd433c7085f4efa33134

SHA256
f524fe9e250c6a0159ebbad3ab06b13be1d0cbd544e21997f81b9d3ec195e6ab

SHA512
25530b160f00691ff00e0264a4cdc84b2285afb8d614d7b6acb21f9203a8a3dc724549cd5ec239d74145b0607227c7c1d7e8cc24fa88dd190f3e0932f84bc5ac

Download Submit
memory/488-261-0x0000000000000000-mapping.dmp

Download
memory/1572-123-0x00007FFF28BC0000-0x00007FFF29CAE000-memory.dmp

Filesize
16.9MB

Download
memory/1572-117-0x00007FFF0EB00000-0x00007FFF0EB10000-memory.dmp

Filesize
64KB

Download
memory/1572-115-0x00007FFF0EB00000-0x00007FFF0EB10000-memory.dmp

Filesize
64KB

Download
memory/1572-116-0x00007FFF0EB00000-0x00007FFF0EB10000-memory.dmp

Filesize
64KB

Download
memory/1572-119-0x00007FFF2F440000-0x00007FFF31F63000-memory.dmp

Filesize
43.1MB

Download
memory/1572-120-0x00007FFF0EB00000-0x00007FFF0EB10000-memory.dmp

Filesize
64KB

Download
memory/1572-374-0x00007FFF0EB00000-0x00007FFF0EB10000-memory.dmp

Filesize
64KB

Download
memory/1572-118-0x00007FFF0EB00000-0x00007FFF0EB10000-memory.dmp

Filesize
64KB

Download
memory/1572-372-0x00007FFF0EB00000-0x00007FFF0EB10000-memory.dmp

Filesize
64KB

Download
memory/1572-124-0x00007FFF26CC0000-0x00007FFF28BB5000-memory.dmp

Filesize
31.0MB

Download
memory/1572-373-0x00007FFF0EB00000-0x00007FFF0EB10000-memory.dmp

Filesize
64KB

Download
memory/1572-371-0x00007FFF0EB00000-0x00007FFF0EB10000-memory.dmp

Filesize
64KB

Download
memory/2164-288-0x0000000000000000-mapping.dmp

Download
memory/2372-303-0x00000000025D0000-0x00000000025E7000-memory.dmp

Filesize
92KB

Download
memory/2372-291-0x0000000000000000-mapping.dmp

Download
memory/4228-307-0x00000166C2B20000-0x00000166C2B37000-memory.dmp

Filesize
92KB

Download
memory/4380-375-0x00007FF7F46A0000-0x00007FF7F46ED000-memory.dmp

Filesize
308KB

Download
memory/4380-376-0x00007FF7F46C66F0-mapping.dmp

Download
memory/4380-377-0x00007FF7F46A0000-0x00007FF7F46ED000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads