bazarbackdoor | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll
Size

172KB
MD5

2c55997f5febc79d8aec77991f178138
SHA1

9d6d02ba0d021b6cdbf1fb8f594ebab3214325da
SHA256

2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894
SHA512

099ad760edaf05a1b180f451c48762627bfc374c8ed2e1ff8969d18787a366495b3576cf7f3724c932d52fa34897e4ee57b7824df9c11d6f6784ec310ee40820

Score

10^/10

bazarbackdoor bazarloader backdoor dropper loader suricata

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

Bazar/Team9 Backdoor payload 3 IoCs

resource	yara_rule
behavioral8/memory/1588-120-0x00007FF73E190000-0x00007FF73E1DC000-memory.dmp	BazarBackdoorVar4
behavioral8/memory/1588-121-0x00007FF73E1B5EC0-mapping.dmp	BazarBackdoorVar4
behavioral8/memory/1588-122-0x00007FF73E190000-0x00007FF73E1DC000-memory.dmp	BazarBackdoorVar4

Bazar/Team9 Loader payload 2 IoCs

resource	yara_rule
behavioral8/memory/2512-118-0x0000000002C70000-0x0000000002D9C000-memory.dmp	BazarLoaderVar6
behavioral8/memory/3380-119-0x0000019E55580000-0x0000019E556AC000-memory.dmp	BazarLoaderVar6

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

flow	ioc
191	ypcawyom.bazar
198	ucemwyem.bazar
130	iqemekyw.bazar
162	vuywuhem.bazar
132	aquheked.bazar
146	tuqeided.bazar
168	tyqeekem.bazar
62	aqsouhyw.bazar
124	ehcaekem.bazar
159	ydcuwyom.bazar
166	izibidom.bazar
183	owomidom.bazar
184	bicuwyed.bazar
185	bicuwyed.bazar
192	ypcawyom.bazar
125	tyibuhed.bazar
128	fuqeidem.bazar
196	etqeekom.bazar
129	lionwyed.bazar
134	bielwyem.bazar
149	tusouhed.bazar
151	aqacidom.bazar
177	iqekekom.bazar
179	aqtowyem.bazar
85	bluehail.bazar
122	uccaeked.bazar
190	ypcawyom.bazar
154	ydewuhom.bazar
173	tysoidem.bazar
181	owomidom.bazar
59	reddew28c.bazar
144	etibidyw.bazar
142	ypudekyw.bazar
189	huwyidem.bazar
57	blackrain15.bazar
141	izywwyed.bazar
161	agidided.bazar
167	etedwyed.bazar
186	ydidekem.bazar
122	ufudided.bazar
156	exomidem.bazar
148	liemekom.bazar
157	exomidem.bazar
195	izeduhem.bazar
86	whitestorm9p.bazar
137	extoekom.bazar
99	ydelwyyw.bazar
115	ypomuhem.bazar
140	vuididom.bazar
153	biekekyw.bazar
175	fuacided.bazar
176	lieluhem.bazar
61	whitestorm9p.bazar
84	reddew28c.bazar
187	agywuhom.bazar
197	ufonidyw.bazar
127	fuqeidem.bazar
150	fuuhwyyw.bazar
158	ydcuwyom.bazar
200	etsoidom.bazar
95	exacuhed.bazar
126	tuedwyyw.bazar
172	ehemeked.bazar
188	exudwyyw.bazar

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

description	flow	ioc
HTTP URL	50	https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8
HTTP URL	81	https://api.opennicproject.org/geoip/?bare&ipv=4&wl=all&res=8

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2512 set thread context of 1588	2512	regsvr32.exe	73

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2512	regsvr32.exe
2512	regsvr32.exe
2512	regsvr32.exe
2512	regsvr32.exe
2512	regsvr32.exe
2512	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73
PID 2512 wrote to memory of 1588	2512	regsvr32.exe	73

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k UnistackSvcGroup
  2⤵
  PID:1588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll,DllRegisterServer {4CE979D1-AD57-4315-B874-DA81845159B9}
1⤵
PID:3380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-120-0x00007FF73E190000-0x00007FF73E1DC000-memory.dmp

Filesize
304KB

Download
memory/1588-122-0x00007FF73E190000-0x00007FF73E1DC000-memory.dmp

Filesize
304KB

Download
memory/2512-118-0x0000000002C70000-0x0000000002D9C000-memory.dmp

Filesize
1.2MB

Download
memory/3380-119-0x0000019E55580000-0x0000019E556AC000-memory.dmp

Filesize
1.2MB

Download