bazarbackdoor | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb.dll
Size

172KB
MD5

f943853cddc15b59823962b28f08b809
SHA1

3e46675756a6f0dc722c620f3bc12610fe27c010
SHA256

6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb
SHA512

1a524916b6af5b071e2d4e533fb302b062383c2edb941a7a6e3d9e92897b2e7f612aa444eeff8c4de6499421f3823d54efa9b375b22c0fe6d301ff1bcb632985

Score

10^/10

bazarbackdoor bazarloader backdoor dropper loader suricata

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

Bazar/Team9 Backdoor payload 3 IoCs

Processes:

resource	yara_rule
behavioral17/memory/1092-120-0x00007FF71D950000-0x00007FF71D99C000-memory.dmp	BazarBackdoorVar4
behavioral17/memory/1092-121-0x00007FF71D975EC0-mapping.dmp	BazarBackdoorVar4
behavioral17/memory/1092-122-0x00007FF71D950000-0x00007FF71D99C000-memory.dmp	BazarBackdoorVar4

Bazar/Team9 Loader payload 3 IoCs

Processes:

resource	yara_rule
behavioral17/memory/1992-118-0x00000000027C0000-0x00000000028EC000-memory.dmp	BazarLoaderVar6
behavioral17/memory/3628-119-0x000002C090ED0000-0x000002C090FFC000-memory.dmp	BazarLoaderVar6
behavioral17/memory/1732-125-0x00000245F6F60000-0x00000245F708C000-memory.dmp	BazarLoaderVar6

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
59	reddew28c.bazar
99	ydelwyyw.bazar
126	tuedwyyw.bazar
138	agcuwyyw.bazar
156	biekekyw.bazar
157	ydewuhom.bazar
165	ufcawyem.bazar
137	huomuhed.bazar
177	lieluhem.bazar
91	owuhekem.bazar
121	etywwyem.bazar
143	ufwyuhom.bazar
158	owtoeked.bazar
164	ypwyuhed.bazar
167	etedwyed.bazar
175	fuacided.bazar
133	bielwyem.bazar
170	ehemeked.bazar
86	whitestorm9p.bazar
61	whitestorm9p.bazar
62	aqsouhyw.bazar
84	reddew28c.bazar
85	bluehail.bazar
95	exacuhed.bazar
151	liemekom.bazar
168	tyqeekem.bazar
103	agekidem.bazar
122	ufudided.bazar
131	aquheked.bazar
120	izididyw.bazar
127	fuqeidem.bazar
134	ydekided.bazar
176	fuacided.bazar
60	bluehail.bazar
123	ucwyuhyw.bazar
128	lionwyed.bazar
132	owacidyw.bazar
149	tuqeided.bazar
152	tusouhed.bazar
145	ufwyuhom.bazar
146	uccaeked.bazar
148	tyedwyom.bazar
57	blackrain15.bazar
129	iqemekyw.bazar
130	fusouhem.bazar
141	ypudekyw.bazar
144	ufwyuhom.bazar
150	ehonuhyw.bazar
160	ydcuwyom.bazar
124	ehcaekem.bazar
163	huudekom.bazar
107	vuewwyed.bazar
111	hutoekyw.bazar
139	vuididom.bazar
142	ufwyuhom.bazar
173	fuacided.bazar
87	aqsouhyw.bazar
135	agewuhyw.bazar
159	exomidem.bazar
161	agidided.bazar
166	izibidom.bazar
169	uconuhom.bazar
174	fuacided.bazar
162	vuywuhem.bazar

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description	flow	ioc
HTTP URL	50	https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8
HTTP URL	81	https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1992 set thread context of 1092 1992 regsvr32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exe

pid process

1992 regsvr32.exe
1992 regsvr32.exe
1992 regsvr32.exe
1992 regsvr32.exe
1992 regsvr32.exe
1992 regsvr32.exe

description	pid	process	target process
PID 1992 set thread context of 1092	1992	regsvr32.exe	svchost.exe

pid	process
1992	regsvr32.exe
1992	regsvr32.exe
1992	regsvr32.exe
1992	regsvr32.exe
1992	regsvr32.exe
1992	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe
PID 1992 wrote to memory of 1092	1992	regsvr32.exe	svchost.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb.dll
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
2⤵
PID:1092

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb.dll,DllRegisterServer {7E1BEB6D-F803-4A02-8AAD-6652C4AF37C6}
1⤵
PID:3628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb.dll,DllRegisterServer {7E1BEB6D-F803-4A02-8AAD-6652C4AF37C6}
1⤵
PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OY8D4S7I\geoip[1].txt
MD5
2a42fadf693cc02ba332e2ebb94b1787

SHA1
9c85f092df98dba884aa206d20882b818450c79b

SHA256
c7ecbb6bd38c2c4cb9462e5f831b7557b6b07160a10ccd3e167ccbf2a2ec4690

SHA512
a031b9e999632d3b0c89203df35786379180ba6d07ace26b947569caf97a8e4951db3e16f36696e998329fa069b8316b3f78d3781195058ae1c7ec3dfc2c73de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QT2UOKDP\hgn30yJXt7[1]
MD5
848d5f1ec31cf2cb44a4d37375358bd9

SHA1
6e4cfb6040e0c68eede8731c14e2dbe2c21d52da

SHA256
175358fb7b625760d8c08b333c2a6686d0704bce909cee58f341e3dc4286f641

SHA512
e49a40cba02648ead95c06c2ef6b8dd5a1c1643771cdeea3d8cca25cd38842617c2031de17cc1f179d0f1a92869b47da4d6d300f5fb7099e7d76131db93e18f0

Download Submit
memory/1092-120-0x00007FF71D950000-0x00007FF71D99C000-memory.dmp

Filesize
304KB

Download
memory/1092-121-0x00007FF71D975EC0-mapping.dmp

Download
memory/1092-122-0x00007FF71D950000-0x00007FF71D99C000-memory.dmp

Filesize
304KB

Download
memory/1732-125-0x00000245F6F60000-0x00000245F708C000-memory.dmp

Filesize
1.2MB

Download
memory/1992-118-0x00000000027C0000-0x00000000028EC000-memory.dmp

Filesize
1.2MB

Download
memory/3628-119-0x000002C090ED0000-0x000002C090FFC000-memory.dmp

Filesize
1.2MB

Download