bazarloader | 2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8

General

Target

2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe
Size

136KB
MD5

b9e7cdd63db7ff765efeaabd0a85ca59
SHA1

7e300cb3e4dc52eaff8dc082c687442df84194c7
SHA256

2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8
SHA512

800e61e0ca304d84a8da9ffd056ccec3c255c8e731f8f5d08f95b70aee65fbace7b6dff9faa0fc6ee0721da8f08cc91ecf14793ef150143dee68dff492bbcacf

Score

10^/10

bazarloader cryptone dropper loader packer persistence

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1496-54-0x0000000140000000-0x0000000140026000-memory.dmp	BazarLoaderVar1
behavioral1/memory/1108-56-0x0000000140000000-0x0000000140026000-memory.dmp	BazarLoaderVar1
behavioral1/memory/1760-67-0x0000000140000000-0x0000000140026000-memory.dmp	BazarLoaderVar1

CryptOne packer 7 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\TT96E4.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\TT96E4.exe	cryptone
\Users\Admin\AppData\Local\Temp\TT96E4.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\TT96E4.exe	cryptone
\Users\Admin\AppData\Local\Temp\TT96E4.exe	cryptone
\Users\Admin\AppData\Local\Temp\TT96E4.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\TT96E4.exe	cryptone

Executes dropped EXE 2 IoCs

Processes:

TT96E4.exeTT96E4.exe

pid process

776 TT96E4.exe
1760 TT96E4.exe

pid	process
776	TT96E4.exe
1760	TT96E4.exe

Tries to connect to .bazar domain 16 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
88	dcegjlecggjp.bazar
89	dcegjlecggjp.bazar
81	dcegjlecggjp.bazar
82	dcegjlecggjp.bazar
90	dcegjlecggjp.bazar
91	dcegjlecggjp.bazar
92	dcegjlecggjp.bazar
80	dcegjlecggjp.bazar
86	dcegjlecggjp.bazar
87	dcegjlecggjp.bazar
95	dcegjlecggjp.bazar
83	dcegjlecggjp.bazar
85	dcegjlecggjp.bazar
93	dcegjlecggjp.bazar
94	dcegjlecggjp.bazar
84	dcegjlecggjp.bazar

Loads dropped DLL 4 IoCs

Processes:

cmd.execmd.exe

pid process

1236 cmd.exe
1236 cmd.exe
928 cmd.exe
928 cmd.exe

pid	process
1236	cmd.exe
1236	cmd.exe
928	cmd.exe
928	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

TT96E4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\MSZGKQRJF5 = "cmd.exe /c reg.exe add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v E2NDYSUXO /t REG_SZ /d \"\\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TT96E4.exe\\\" K5ZU\" & start \"H\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\TT96E4.exe\" K5ZU"	TT96E4.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

1984 PING.EXE
1344 PING.EXE
1660 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe

pid process

1496 2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe

pid	process
1984	PING.EXE
1344	PING.EXE
1660	PING.EXE

pid	process
1496	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.execmd.exe2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.execmd.exeTT96E4.execmd.exe

description	pid	process	target process
PID 1496 wrote to memory of 828	1496	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe	cmd.exe
PID 1496 wrote to memory of 828	1496	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe	cmd.exe
PID 1496 wrote to memory of 828	1496	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe	cmd.exe
PID 828 wrote to memory of 1344	828	cmd.exe	PING.EXE
PID 828 wrote to memory of 1344	828	cmd.exe	PING.EXE
PID 828 wrote to memory of 1344	828	cmd.exe	PING.EXE
PID 828 wrote to memory of 1108	828	cmd.exe	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe
PID 828 wrote to memory of 1108	828	cmd.exe	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe
PID 828 wrote to memory of 1108	828	cmd.exe	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe
PID 1108 wrote to memory of 1236	1108	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe	cmd.exe
PID 1108 wrote to memory of 1236	1108	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe	cmd.exe
PID 1108 wrote to memory of 1236	1108	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe	cmd.exe
PID 1236 wrote to memory of 1660	1236	cmd.exe	PING.EXE
PID 1236 wrote to memory of 1660	1236	cmd.exe	PING.EXE
PID 1236 wrote to memory of 1660	1236	cmd.exe	PING.EXE
PID 1236 wrote to memory of 776	1236	cmd.exe	TT96E4.exe
PID 1236 wrote to memory of 776	1236	cmd.exe	TT96E4.exe
PID 1236 wrote to memory of 776	1236	cmd.exe	TT96E4.exe
PID 776 wrote to memory of 928	776	TT96E4.exe	cmd.exe
PID 776 wrote to memory of 928	776	TT96E4.exe	cmd.exe
PID 776 wrote to memory of 928	776	TT96E4.exe	cmd.exe
PID 928 wrote to memory of 1984	928	cmd.exe	PING.EXE
PID 928 wrote to memory of 1984	928	cmd.exe	PING.EXE
PID 928 wrote to memory of 1984	928	cmd.exe	PING.EXE
PID 928 wrote to memory of 1760	928	cmd.exe	TT96E4.exe
PID 928 wrote to memory of 1760	928	cmd.exe	TT96E4.exe
PID 928 wrote to memory of 1760	928	cmd.exe	TT96E4.exe

C:\Users\Admin\AppData\Local\Temp\2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe
"C:\Users\Admin\AppData\Local\Temp\2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\system32\cmd.exe
cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe YJ5G5T
2⤵
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\system32\PING.EXE
ping 8.8.8.8 -n 2
3⤵
- Runs ping.exe
PID:1344

C:\Users\Admin\AppData\Local\Temp\2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe
C:\Users\Admin\AppData\Local\Temp\2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe YJ5G5T
3⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\system32\cmd.exe
cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\TT96E4.exe GQ00VDP
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\system32\PING.EXE
ping 8.8.8.8 -n 2
5⤵
- Runs ping.exe
PID:1660

C:\Users\Admin\AppData\Local\Temp\TT96E4.exe
C:\Users\Admin\AppData\Local\Temp\TT96E4.exe GQ00VDP
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\system32\cmd.exe
cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\TT96E4.exe K5ZU
6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:928

C:\Windows\system32\PING.EXE
ping 8.8.8.8 -n 2
7⤵
- Runs ping.exe
PID:1984

C:\Users\Admin\AppData\Local\Temp\TT96E4.exe
C:\Users\Admin\AppData\Local\Temp\TT96E4.exe K5ZU
7⤵
- Executes dropped EXE
PID:1760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TT96E4.exe
MD5
b9e7cdd63db7ff765efeaabd0a85ca59

SHA1
7e300cb3e4dc52eaff8dc082c687442df84194c7

SHA256
2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8

SHA512
800e61e0ca304d84a8da9ffd056ccec3c255c8e731f8f5d08f95b70aee65fbace7b6dff9faa0fc6ee0721da8f08cc91ecf14793ef150143dee68dff492bbcacf

Download Submit
C:\Users\Admin\AppData\Local\Temp\TT96E4.exe
MD5
b9e7cdd63db7ff765efeaabd0a85ca59

SHA1
7e300cb3e4dc52eaff8dc082c687442df84194c7

SHA256
2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8

SHA512
800e61e0ca304d84a8da9ffd056ccec3c255c8e731f8f5d08f95b70aee65fbace7b6dff9faa0fc6ee0721da8f08cc91ecf14793ef150143dee68dff492bbcacf

Download Submit
C:\Users\Admin\AppData\Local\Temp\TT96E4.exe
MD5
b9e7cdd63db7ff765efeaabd0a85ca59

SHA1
7e300cb3e4dc52eaff8dc082c687442df84194c7

SHA256
2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8

SHA512
800e61e0ca304d84a8da9ffd056ccec3c255c8e731f8f5d08f95b70aee65fbace7b6dff9faa0fc6ee0721da8f08cc91ecf14793ef150143dee68dff492bbcacf

Download Submit
\Users\Admin\AppData\Local\Temp\TT96E4.exe
MD5
b9e7cdd63db7ff765efeaabd0a85ca59

SHA1
7e300cb3e4dc52eaff8dc082c687442df84194c7

SHA256
2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8

SHA512
800e61e0ca304d84a8da9ffd056ccec3c255c8e731f8f5d08f95b70aee65fbace7b6dff9faa0fc6ee0721da8f08cc91ecf14793ef150143dee68dff492bbcacf

Download Submit
\Users\Admin\AppData\Local\Temp\TT96E4.exe
MD5
b9e7cdd63db7ff765efeaabd0a85ca59

SHA1
7e300cb3e4dc52eaff8dc082c687442df84194c7

SHA256
2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8

SHA512
800e61e0ca304d84a8da9ffd056ccec3c255c8e731f8f5d08f95b70aee65fbace7b6dff9faa0fc6ee0721da8f08cc91ecf14793ef150143dee68dff492bbcacf

Download Submit
\Users\Admin\AppData\Local\Temp\TT96E4.exe
MD5
b9e7cdd63db7ff765efeaabd0a85ca59

SHA1
7e300cb3e4dc52eaff8dc082c687442df84194c7

SHA256
2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8

SHA512
800e61e0ca304d84a8da9ffd056ccec3c255c8e731f8f5d08f95b70aee65fbace7b6dff9faa0fc6ee0721da8f08cc91ecf14793ef150143dee68dff492bbcacf

Download Submit
\Users\Admin\AppData\Local\Temp\TT96E4.exe
MD5
b9e7cdd63db7ff765efeaabd0a85ca59

SHA1
7e300cb3e4dc52eaff8dc082c687442df84194c7

SHA256
2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8

SHA512
800e61e0ca304d84a8da9ffd056ccec3c255c8e731f8f5d08f95b70aee65fbace7b6dff9faa0fc6ee0721da8f08cc91ecf14793ef150143dee68dff492bbcacf

Download Submit
memory/776-63-0x00000000001D0000-0x00000000001E5000-memory.dmp

Filesize
84KB

Download
memory/1108-57-0x00000000001D0000-0x00000000001E5000-memory.dmp

Filesize
84KB

Download
memory/1108-56-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/1496-54-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/1496-55-0x0000000000160000-0x0000000000175000-memory.dmp

Filesize
84KB

Download
memory/1760-67-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/1760-68-0x00000000003D0000-0x00000000003E5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads