Analysis
-
max time kernel
118s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
20-10-2021 17:57
Static task
static1
Behavioral task
behavioral1
Sample
Documents.lnk
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Documents.lnk
Resource
win10-en-20211014
Behavioral task
behavioral3
Sample
Documents.tmp.dll
Resource
win7-en-20210920
Behavioral task
behavioral4
Sample
Documents.tmp.dll
Resource
win10-en-20210920
General
-
Target
Documents.lnk
-
Size
1KB
-
MD5
857402be70e2963aebaed2162585dfed
-
SHA1
de55e131a8e20331f170aa6cdaca522bcf549f29
-
SHA256
d982cd19473751d5d32f749e198e42d4cae2548eae65b532d0d121a275f62b8f
-
SHA512
f61f8670c035f9a3d3de25a6b15abd0b974debb721338c7bbf1fd38734f6c02a121d87a0ec6caa29992a66d19da28ff07667f0e8ffb19fdc1e5f8c467e9ca7e9
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/616-62-0x0000000180001000-0x000000018002A000-memory.dmp BazarLoaderVar5 -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 4 616 rundll32.exe 6 616 rundll32.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1580 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 616 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 1688 wrote to memory of 1580 1688 cmd.exe cmd.exe PID 1688 wrote to memory of 1580 1688 cmd.exe cmd.exe PID 1688 wrote to memory of 1580 1688 cmd.exe cmd.exe PID 1580 wrote to memory of 1044 1580 cmd.exe xcopy.exe PID 1580 wrote to memory of 1044 1580 cmd.exe xcopy.exe PID 1580 wrote to memory of 1044 1580 cmd.exe xcopy.exe PID 1580 wrote to memory of 616 1580 cmd.exe rundll32.exe PID 1580 wrote to memory of 616 1580 cmd.exe rundll32.exe PID 1580 wrote to memory of 616 1580 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Documents.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C xcopy /H Documents.tmp c:\programdata && start rundll32.exe c:\programdata\Documents.tmp,EnterDll && del Documents.lnk && del Documents.tmp && mkdir Documents && exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\xcopy.exexcopy /H Documents.tmp c:\programdata3⤵
-
C:\Windows\system32\rundll32.exerundll32.exe c:\programdata\Documents.tmp,EnterDll3⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\programdata\Documents.tmpMD5
d7e7cf2ed643c84f35da54f6abbc8409
SHA14eaff70353abf1a9d1caf840d7a23c3f72fc5bb6
SHA2564374f12287c158cc6e9421640b459455307e471711cc41f5666a1cbc553a3eb3
SHA512cdf21fdcece645df88392bb9a0a865cb6ff5180d25bdeffab3a781c58612c84e0b2de1cbca8dacbfd307e3afcaf1fb5f60527f572c6b6098a43defc142799b21
-
\ProgramData\Documents.tmpMD5
d7e7cf2ed643c84f35da54f6abbc8409
SHA14eaff70353abf1a9d1caf840d7a23c3f72fc5bb6
SHA2564374f12287c158cc6e9421640b459455307e471711cc41f5666a1cbc553a3eb3
SHA512cdf21fdcece645df88392bb9a0a865cb6ff5180d25bdeffab3a781c58612c84e0b2de1cbca8dacbfd307e3afcaf1fb5f60527f572c6b6098a43defc142799b21
-
memory/616-58-0x0000000000000000-mapping.dmp
-
memory/616-61-0x0000000001AF0000-0x0000000001B13000-memory.dmpFilesize
140KB
-
memory/616-62-0x0000000180001000-0x000000018002A000-memory.dmpFilesize
164KB
-
memory/1044-57-0x0000000000000000-mapping.dmp
-
memory/1580-56-0x0000000000000000-mapping.dmp
-
memory/1688-55-0x000007FEFB831000-0x000007FEFB833000-memory.dmpFilesize
8KB