bazarbackdoor | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

a55c19c552f579041ad7289aceeb400da215fe29aedbf0c14e8a66be1bee8360.dll
Size

172KB
MD5

7a70755b8388c0bc73c7cdc557150dca
SHA1

8ed83eeadcda38d92ab079a7b8483cbdb8cc3ac1
SHA256

a55c19c552f579041ad7289aceeb400da215fe29aedbf0c14e8a66be1bee8360
SHA512

a9347e82c9cb77be18841badf0fccece9a860a48fa17ad3ad410120cc6bd6fa585758c9071c4627d22b8a49eee615032cc4448cfb1860be87b3ea77311e5616f

Score

10^/10

bazarbackdoor bazarloader backdoor dropper loader suricata

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

Bazar/Team9 Backdoor payload 3 IoCs

Processes:

resource	yara_rule
behavioral23/memory/348-120-0x00007FF7496B0000-0x00007FF7496FC000-memory.dmp	BazarBackdoorVar4
behavioral23/memory/348-121-0x00007FF7496D5EC0-mapping.dmp	BazarBackdoorVar4
behavioral23/memory/348-122-0x00007FF7496B0000-0x00007FF7496FC000-memory.dmp	BazarBackdoorVar4

Bazar/Team9 Loader payload 3 IoCs

Processes:

resource	yara_rule
behavioral23/memory/2800-118-0x00000000022E0000-0x000000000240C000-memory.dmp	BazarLoaderVar6
behavioral23/memory/1916-119-0x00000200FEA50000-0x00000200FEB7C000-memory.dmp	BazarLoaderVar6
behavioral23/memory/1276-125-0x0000022F83EC0000-0x0000022F83FEC000-memory.dmp	BazarLoaderVar6

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
168	fuacided.bazar
190	aqomekyw.bazar
156	agidided.bazar
93	exacuhed.bazar
142	etibidyw.bazar
147	tusouhed.bazar
151	biekekyw.bazar
200	yponidem.bazar
85	aqsouhyw.bazar
120	ufudided.bazar
133	agewuhyw.bazar
182	ucemwyem.bazar
228	ufelidom.bazar
60	aqsouhyw.bazar
179	vuibekyw.bazar
219	excauhom.bazar
236	ehcuidyw.bazar
175	agywuhom.bazar
138	izywwyed.bazar
152	ydewuhom.bazar
201	ufemwyed.bazar
212	tutouhyw.bazar
223	huonided.bazar
124	tuedwyyw.bazar
150	iqelwyed.bazar
166	tysoidem.bazar
211	liewided.bazar
233	tuomeked.bazar
237	ehcuidyw.bazar
122	ehcaekem.bazar
141	uccaeked.bazar
154	exomidem.bazar
155	ydcuwyom.bazar
164	uconuhom.bazar
165	ehemeked.bazar
206	ucelidyw.bazar
222	vuqewyom.bazar
83	bluehail.bazar
162	etedwyed.bazar
173	owomidom.bazar
186	eheluhom.bazar
225	vusoekom.bazar
135	huomuhed.bazar
230	ehewekyw.bazar
209	liewided.bazar
195	exwyided.bazar
205	tyaceked.bazar
231	tytouhom.bazar
167	tuuhwyom.bazar
187	liekwyyw.bazar
196	hucauhyw.bazar
199	izqewyyw.bazar
125	fuqeidem.bazar
160	ufcawyem.bazar
121	ucwyuhyw.bazar
161	izibidom.bazar
227	etacwyyw.bazar
157	vuywuhem.bazar
127	iqemekyw.bazar
136	agcuwyyw.bazar
153	owtoeked.bazar
184	tyuhuhyw.bazar
207	ehekwyem.bazar
224	ypemuhyw.bazar

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description	flow	ioc
HTTP URL	48	https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8
HTTP URL	79	https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 2800 set thread context of 348 2800 regsvr32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exe

pid process

2800 regsvr32.exe
2800 regsvr32.exe
2800 regsvr32.exe
2800 regsvr32.exe
2800 regsvr32.exe
2800 regsvr32.exe

description	pid	process	target process
PID 2800 set thread context of 348	2800	regsvr32.exe	svchost.exe

pid	process
2800	regsvr32.exe
2800	regsvr32.exe
2800	regsvr32.exe
2800	regsvr32.exe
2800	regsvr32.exe
2800	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe
PID 2800 wrote to memory of 348	2800	regsvr32.exe	svchost.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a55c19c552f579041ad7289aceeb400da215fe29aedbf0c14e8a66be1bee8360.dll
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
2⤵
PID:348

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\a55c19c552f579041ad7289aceeb400da215fe29aedbf0c14e8a66be1bee8360.dll,DllRegisterServer {B0B5A78B-43C7-4364-A2EC-974A10311EAC}
1⤵
PID:1916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\a55c19c552f579041ad7289aceeb400da215fe29aedbf0c14e8a66be1bee8360.dll,DllRegisterServer {B0B5A78B-43C7-4364-A2EC-974A10311EAC}
1⤵
PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1BA3P8U7\yRjjXeBKtP[1]
MD5
1cfff1bb6a8c9e33c89eb71bab632e40

SHA1
5163578f4a4a0d5c17dc8fadcbe806758974d638

SHA256
817168832a2e409728cafbf935c46287457f5afb335a075de77de67290501ca0

SHA512
8e4ca41625d62ee7904f8f15cef8dead476a3489596cce301dbc64dd876aa31ea7e0ee0be55aa8855df21ef9a8492e3c0337ee5601721aa7f0ce03def415b01d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BNAKBOQY\geoip[1].txt
MD5
2a42fadf693cc02ba332e2ebb94b1787

SHA1
9c85f092df98dba884aa206d20882b818450c79b

SHA256
c7ecbb6bd38c2c4cb9462e5f831b7557b6b07160a10ccd3e167ccbf2a2ec4690

SHA512
a031b9e999632d3b0c89203df35786379180ba6d07ace26b947569caf97a8e4951db3e16f36696e998329fa069b8316b3f78d3781195058ae1c7ec3dfc2c73de

Download Submit
memory/348-120-0x00007FF7496B0000-0x00007FF7496FC000-memory.dmp

Filesize
304KB

Download
memory/348-121-0x00007FF7496D5EC0-mapping.dmp

Download
memory/348-122-0x00007FF7496B0000-0x00007FF7496FC000-memory.dmp

Filesize
304KB

Download
memory/1276-125-0x0000022F83EC0000-0x0000022F83FEC000-memory.dmp

Filesize
1.2MB

Download
memory/1916-119-0x00000200FEA50000-0x00000200FEB7C000-memory.dmp

Filesize
1.2MB

Download
memory/2800-118-0x00000000022E0000-0x000000000240C000-memory.dmp

Filesize
1.2MB

Download