Overview

overview

10

Static

static

TIMECLOCK.exe

windows7_x64

10

TIMECLOCK.exe

windows10-2004_x64

10

Resubmissions

18-01-2022 06:34

220118-hb7wyaabep 10

15-09-2021 06:41

210915-hf8n2adaeq 10

15-09-2021 06:33

210915-hbdm4adael 1

Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    18-01-2022 06:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TIMECLOCK.exe

  • Size

    460KB

  • MD5

    513b43a30628978d52d18912b72dcdd0

  • SHA1

    97368003849122e99dc7b0e25b4b37b2999053ee

  • SHA256

    47bac27be954cf593ac731cd57fa98b565cf5036a6fbf35c508549f039eea8f3

  • SHA512

    a8e846109b644df3e905e33ae2218b5f0c7f65efd2a202c2d2c38a89d2e979d4379862b545523b7338855f51f087ad4d7c41746197e9f233e938ed4bbfbb5c0c

Score
10/10
bazarloaderdropperloader

Malware Config

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Bazar/Team9 Loader payload 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TIMECLOCK.exe
    "C:\Users\Admin\AppData\Local\Temp\TIMECLOCK.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3860
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
    1⤵
      PID:2212
    • C:\Users\Admin\AppData\Local\Temp\TIMECLOCK.exe
      C:\Users\Admin\AppData\Local\Temp\TIMECLOCK.exe {F4AE6CD9-E20E-40FC-B98C-DD1068FD9665}
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4052

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3860-133-0x00000000022E0000-0x00000000024B0000-memory.dmp
      Filesize

      1.8MB

      Download
    • memory/4052-137-0x00000000023B0000-0x00000000023C4000-memory.dmp
      Filesize

      80KB

      Download
    • memory/4052-140-0x00000000023D0000-0x00000000023E6000-memory.dmp
      Filesize

      88KB

      Download
    • memory/4052-143-0x0000000002390000-0x00000000023A2000-memory.dmp
      Filesize

      72KB

      Download