bazarbackdoor | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll
Size

172KB
MD5

2c55997f5febc79d8aec77991f178138
SHA1

9d6d02ba0d021b6cdbf1fb8f594ebab3214325da
SHA256

2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894
SHA512

099ad760edaf05a1b180f451c48762627bfc374c8ed2e1ff8969d18787a366495b3576cf7f3724c932d52fa34897e4ee57b7824df9c11d6f6784ec310ee40820

Score

10^/10

bazarbackdoor bazarloader backdoor dropper loader suricata

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

Bazar/Team9 Backdoor payload 3 IoCs

Processes:

resource	yara_rule
behavioral8/memory/1588-120-0x00007FF73E190000-0x00007FF73E1DC000-memory.dmp	BazarBackdoorVar4
behavioral8/memory/1588-121-0x00007FF73E1B5EC0-mapping.dmp	BazarBackdoorVar4
behavioral8/memory/1588-122-0x00007FF73E190000-0x00007FF73E1DC000-memory.dmp	BazarBackdoorVar4

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral8/memory/2512-118-0x0000000002C70000-0x0000000002D9C000-memory.dmp	BazarLoaderVar6
behavioral8/memory/3380-119-0x0000019E55580000-0x0000019E556AC000-memory.dmp	BazarLoaderVar6

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
191	ypcawyom.bazar
198	ucemwyem.bazar
130	iqemekyw.bazar
162	vuywuhem.bazar
132	aquheked.bazar
146	tuqeided.bazar
168	tyqeekem.bazar
62	aqsouhyw.bazar
124	ehcaekem.bazar
159	ydcuwyom.bazar
166	izibidom.bazar
183	owomidom.bazar
184	bicuwyed.bazar
185	bicuwyed.bazar
192	ypcawyom.bazar
125	tyibuhed.bazar
128	fuqeidem.bazar
196	etqeekom.bazar
129	lionwyed.bazar
134	bielwyem.bazar
149	tusouhed.bazar
151	aqacidom.bazar
177	iqekekom.bazar
179	aqtowyem.bazar
85	bluehail.bazar
122	uccaeked.bazar
190	ypcawyom.bazar
154	ydewuhom.bazar
173	tysoidem.bazar
181	owomidom.bazar
59	reddew28c.bazar
144	etibidyw.bazar
142	ypudekyw.bazar
189	huwyidem.bazar
57	blackrain15.bazar
141	izywwyed.bazar
161	agidided.bazar
167	etedwyed.bazar
186	ydidekem.bazar
122	ufudided.bazar
156	exomidem.bazar
148	liemekom.bazar
157	exomidem.bazar
195	izeduhem.bazar
86	whitestorm9p.bazar
137	extoekom.bazar
99	ydelwyyw.bazar
115	ypomuhem.bazar
140	vuididom.bazar
153	biekekyw.bazar
175	fuacided.bazar
176	lieluhem.bazar
61	whitestorm9p.bazar
84	reddew28c.bazar
187	agywuhom.bazar
197	ufonidyw.bazar
127	fuqeidem.bazar
150	fuuhwyyw.bazar
158	ydcuwyom.bazar
200	etsoidom.bazar
95	exacuhed.bazar
126	tuedwyyw.bazar
172	ehemeked.bazar
188	exudwyyw.bazar

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

description	flow	ioc
HTTP URL	50	https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8
HTTP URL	81	https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 2512 set thread context of 1588 2512 regsvr32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exe

pid process

2512 regsvr32.exe
2512 regsvr32.exe
2512 regsvr32.exe
2512 regsvr32.exe
2512 regsvr32.exe
2512 regsvr32.exe

description	pid	process	target process
PID 2512 set thread context of 1588	2512	regsvr32.exe	svchost.exe

pid	process
2512	regsvr32.exe
2512	regsvr32.exe
2512	regsvr32.exe
2512	regsvr32.exe
2512	regsvr32.exe
2512	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	svchost.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
2⤵
PID:1588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll,DllRegisterServer {4CE979D1-AD57-4315-B874-DA81845159B9}
1⤵
PID:3380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OY8D4S7I\geoip[1].txt
MD5
2a42fadf693cc02ba332e2ebb94b1787

SHA1
9c85f092df98dba884aa206d20882b818450c79b

SHA256
c7ecbb6bd38c2c4cb9462e5f831b7557b6b07160a10ccd3e167ccbf2a2ec4690

SHA512
a031b9e999632d3b0c89203df35786379180ba6d07ace26b947569caf97a8e4951db3e16f36696e998329fa069b8316b3f78d3781195058ae1c7ec3dfc2c73de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QT2UOKDP\ucNrA5Xb3Q[1]
MD5
b8f526c1b86dce6296dce90f004902e6

SHA1
13632e7a4e9e5ecc7a951567fe12db9d1cb74c5c

SHA256
da16f58262053dffd06e0980e5358e67ed3003255f4c05ee539ce24ed7d08f72

SHA512
5905c4ff467e1ca8d88b4b265de9b7b23441b6fcecb458f49dd420055f41e03be068afc8f3b424cc253108081d99c85d629ed054aeb536d39f9843650f31cc3f

Download Submit
memory/1588-120-0x00007FF73E190000-0x00007FF73E1DC000-memory.dmp

Filesize
304KB

Download
memory/1588-121-0x00007FF73E1B5EC0-mapping.dmp

Download
memory/1588-122-0x00007FF73E190000-0x00007FF73E1DC000-memory.dmp

Filesize
304KB

Download
memory/2512-118-0x0000000002C70000-0x0000000002D9C000-memory.dmp

Filesize
1.2MB

Download
memory/3380-119-0x0000019E55580000-0x0000019E556AC000-memory.dmp

Filesize
1.2MB

Download