bazarbackdoor | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

fe028e6f99a02a016643a2db14534fa977a78f45b36ff9db5b60e7e709f5541c.dll
Size

172KB
MD5

a3d0c939bd3ecb8d11bd06c2bd15f45e
SHA1

b7fcdacc3507ed2f84752068fb0039c600003536
SHA256

fe028e6f99a02a016643a2db14534fa977a78f45b36ff9db5b60e7e709f5541c
SHA512

40a6bf12a8aedf563ae762249b8d5c44c39a1002ec581f07f1ff0f5b91dd6dfe6badadd71ae15efa608e129e5b3389390bf62d40dca9fddca2e04bd37e045f52

Score

10^/10

bazarbackdoor bazarloader backdoor dropper loader suricata

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

Bazar/Team9 Backdoor payload 3 IoCs

Processes:

resource	yara_rule
behavioral32/memory/3176-121-0x00007FF622FB5EC0-mapping.dmp	BazarBackdoorVar4
behavioral32/memory/3176-120-0x00007FF622F90000-0x00007FF622FDC000-memory.dmp	BazarBackdoorVar4
behavioral32/memory/3176-122-0x00007FF622F90000-0x00007FF622FDC000-memory.dmp	BazarBackdoorVar4

Bazar/Team9 Loader payload 3 IoCs

Processes:

resource	yara_rule
behavioral32/memory/3136-118-0x0000000002860000-0x000000000298C000-memory.dmp	BazarLoaderVar6
behavioral32/memory/360-119-0x000002209CEC0000-0x000002209CFEC000-memory.dmp	BazarLoaderVar6
behavioral32/memory/3268-125-0x000001EA95290000-0x000001EA953BC000-memory.dmp	BazarLoaderVar6

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
513	etibuhed.bazar
755	ufsoidom.bazar
810	aqibwyyw.bazar
855	exacuhem.bazar
618	ucewekem.bazar
179	huwyidem.bazar
232	tuomeked.bazar
339	ehqeided.bazar
515	tuqeidom.bazar
537	tuuhwyem.bazar
583	aqudwyom.bazar
739	tueluhyw.bazar
835	exuhidom.bazar
201	vueduhed.bazar
302	ydacuhed.bazar
337	ufibidem.bazar
495	tuedeked.bazar
573	izsoided.bazar
499	fusouhyw.bazar
629	biedidom.bazar
667	tywywyom.bazar
153	ydewuhom.bazar
167	tysoidem.bazar
268	ufewwyyw.bazar
386	tuekwyyw.bazar
438	owedidom.bazar
692	tycaekem.bazar
124	tuedwyyw.bazar
241	agqewyed.bazar
418	exedidem.bazar
479	biemidem.bazar
635	vuacwyed.bazar
137	agcuwyyw.bazar
298	fuonwyem.bazar
454	liwywyyw.bazar
593	izuhuhom.bazar
612	agsoekom.bazar
673	aqemidom.bazar
693	ucibuhom.bazar
134	agewuhyw.bazar
265	vuacuhyw.bazar
405	etelidyw.bazar
419	huqewyom.bazar
563	biidekem.bazar
850	aqqeuhom.bazar
917	owomidyw.bazar
222	vuqewyom.bazar
424	ufacwyem.bazar
607	biibeked.bazar
816	huuhidyw.bazar
196	ydywidyw.bazar
276	fucaidom.bazar
589	vuqewyem.bazar
623	liywekyw.bazar
763	fuewidyw.bazar
380	etemwyem.bazar
512	uccaekom.bazar
767	aqidekom.bazar
171	iqekekom.bazar
172	biewuhed.bazar
269	iztoidem.bazar
272	uciduhem.bazar
338	ucedwyom.bazar
768	owywuhed.bazar

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description	flow	ioc
HTTP URL	47	https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8
HTTP URL	78	https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 3136 set thread context of 3176 3136 regsvr32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exe

pid process

3136 regsvr32.exe
3136 regsvr32.exe
3136 regsvr32.exe
3136 regsvr32.exe
3136 regsvr32.exe
3136 regsvr32.exe

description	pid	process	target process
PID 3136 set thread context of 3176	3136	regsvr32.exe	svchost.exe

pid	process
3136	regsvr32.exe
3136	regsvr32.exe
3136	regsvr32.exe
3136	regsvr32.exe
3136	regsvr32.exe
3136	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe
PID 3136 wrote to memory of 3176	3136	regsvr32.exe	svchost.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fe028e6f99a02a016643a2db14534fa977a78f45b36ff9db5b60e7e709f5541c.dll
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
2⤵
PID:3176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe028e6f99a02a016643a2db14534fa977a78f45b36ff9db5b60e7e709f5541c.dll,DllRegisterServer {3D966DB7-3A12-47F8-A946-86754A29F1D1}
1⤵
PID:360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe028e6f99a02a016643a2db14534fa977a78f45b36ff9db5b60e7e709f5541c.dll,DllRegisterServer {3D966DB7-3A12-47F8-A946-86754A29F1D1}
1⤵
PID:3268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1BA3P8U7\qCzma0yRw3[1]
MD5
4f55b5243ca60c52c40c48efc429e9c6

SHA1
f7a44b86a69c05a67ec3ee8802e9e7dbeef7eae3

SHA256
b819014abf96bc6584f9c8cc553886bc1c3b3acaa84e6e192085eec99fabd95f

SHA512
a4158a9e09bc3fcddddae9a75afb4d6a49b06fd448dae36daeb0344d83f8db2cbaaf47e39bb4f1d30b0e15eae4c2d1753b1a82712f69f7c13d664a0bb17663c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BNAKBOQY\geoip[1].txt
MD5
2a42fadf693cc02ba332e2ebb94b1787

SHA1
9c85f092df98dba884aa206d20882b818450c79b

SHA256
c7ecbb6bd38c2c4cb9462e5f831b7557b6b07160a10ccd3e167ccbf2a2ec4690

SHA512
a031b9e999632d3b0c89203df35786379180ba6d07ace26b947569caf97a8e4951db3e16f36696e998329fa069b8316b3f78d3781195058ae1c7ec3dfc2c73de

Download Submit
memory/360-119-0x000002209CEC0000-0x000002209CFEC000-memory.dmp

Filesize
1.2MB

Download
memory/3136-118-0x0000000002860000-0x000000000298C000-memory.dmp

Filesize
1.2MB

Download
memory/3176-121-0x00007FF622FB5EC0-mapping.dmp

Download
memory/3176-120-0x00007FF622F90000-0x00007FF622FDC000-memory.dmp

Filesize
304KB

Download
memory/3176-122-0x00007FF622F90000-0x00007FF622FDC000-memory.dmp

Filesize
304KB

Download
memory/3268-125-0x000001EA95290000-0x000001EA953BC000-memory.dmp

Filesize
1.2MB

Download