bazarloader | 2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8

General

Target

2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe
Size

136KB
MD5

b9e7cdd63db7ff765efeaabd0a85ca59
SHA1

7e300cb3e4dc52eaff8dc082c687442df84194c7
SHA256

2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8
SHA512

800e61e0ca304d84a8da9ffd056ccec3c255c8e731f8f5d08f95b70aee65fbace7b6dff9faa0fc6ee0721da8f08cc91ecf14793ef150143dee68dff492bbcacf

Score

10^/10

bazarloader cryptone dropper loader packer persistence

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1836-130-0x0000000140000000-0x0000000140026000-memory.dmp	BazarLoaderVar1
behavioral2/memory/220-132-0x0000000140000000-0x0000000140026000-memory.dmp	BazarLoaderVar1
behavioral2/memory/3780-136-0x0000000140000000-0x0000000140026000-memory.dmp	BazarLoaderVar1
behavioral2/memory/4908-139-0x0000000140000000-0x0000000140026000-memory.dmp	BazarLoaderVar1

CryptOne packer 3 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\NFKA878.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\NFKA878.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\NFKA878.exe	cryptone

Executes dropped EXE 2 IoCs

Processes:

NFKA878.exeNFKA878.exe

pid process

3780 NFKA878.exe
4908 NFKA878.exe

pid	process
3780	NFKA878.exe
4908	NFKA878.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

NFKA878.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\PO6K50T40UU = "cmd.exe /c reg.exe add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v LRR3YF04 /t REG_SZ /d \"\\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NFKA878.exe\\\" PIKDI\" & start \"H\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\NFKA878.exe\" PIKDI"	NFKA878.exe

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

5076 PING.EXE
3104 PING.EXE
2628 PING.EXE

pid	process
5076	PING.EXE
3104	PING.EXE
2628	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe

pid	process
1836	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe
1836	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	624	svchost.exe
Token: SeCreatePagefilePrivilege	624	svchost.exe
Token: SeShutdownPrivilege	624	svchost.exe
Token: SeCreatePagefilePrivilege	624	svchost.exe
Token: SeShutdownPrivilege	624	svchost.exe
Token: SeCreatePagefilePrivilege	624	svchost.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.execmd.exe2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.execmd.exeNFKA878.execmd.exe

description	pid	process	target process
PID 1836 wrote to memory of 2856	1836	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe	cmd.exe
PID 1836 wrote to memory of 2856	1836	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe	cmd.exe
PID 2856 wrote to memory of 5076	2856	cmd.exe	PING.EXE
PID 2856 wrote to memory of 5076	2856	cmd.exe	PING.EXE
PID 2856 wrote to memory of 220	2856	cmd.exe	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe
PID 2856 wrote to memory of 220	2856	cmd.exe	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe
PID 220 wrote to memory of 4480	220	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe	cmd.exe
PID 220 wrote to memory of 4480	220	2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe	cmd.exe
PID 4480 wrote to memory of 3104	4480	cmd.exe	PING.EXE
PID 4480 wrote to memory of 3104	4480	cmd.exe	PING.EXE
PID 4480 wrote to memory of 3780	4480	cmd.exe	NFKA878.exe
PID 4480 wrote to memory of 3780	4480	cmd.exe	NFKA878.exe
PID 3780 wrote to memory of 2264	3780	NFKA878.exe	cmd.exe
PID 3780 wrote to memory of 2264	3780	NFKA878.exe	cmd.exe
PID 2264 wrote to memory of 2628	2264	cmd.exe	PING.EXE
PID 2264 wrote to memory of 2628	2264	cmd.exe	PING.EXE
PID 2264 wrote to memory of 4908	2264	cmd.exe	NFKA878.exe
PID 2264 wrote to memory of 4908	2264	cmd.exe	NFKA878.exe

C:\Users\Admin\AppData\Local\Temp\2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe
"C:\Users\Admin\AppData\Local\Temp\2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SYSTEM32\cmd.exe
cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe DDEOB3L
2⤵
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\system32\PING.EXE
ping 8.8.8.8 -n 2
3⤵
- Runs ping.exe
PID:5076

C:\Users\Admin\AppData\Local\Temp\2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe
C:\Users\Admin\AppData\Local\Temp\2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8.exe DDEOB3L
3⤵
- Suspicious use of WriteProcessMemory
PID:220

C:\Windows\SYSTEM32\cmd.exe
cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\NFKA878.exe BZ8SRX
4⤵
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\system32\PING.EXE
ping 8.8.8.8 -n 2
5⤵
- Runs ping.exe
PID:3104

C:\Users\Admin\AppData\Local\Temp\NFKA878.exe
C:\Users\Admin\AppData\Local\Temp\NFKA878.exe BZ8SRX
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3780

C:\Windows\SYSTEM32\cmd.exe
cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\NFKA878.exe PIKDI
6⤵
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\system32\PING.EXE
ping 8.8.8.8 -n 2
7⤵
- Runs ping.exe
PID:2628

C:\Users\Admin\AppData\Local\Temp\NFKA878.exe
C:\Users\Admin\AppData\Local\Temp\NFKA878.exe PIKDI
7⤵
- Executes dropped EXE
PID:4908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NFKA878.exe
MD5
b9e7cdd63db7ff765efeaabd0a85ca59

SHA1
7e300cb3e4dc52eaff8dc082c687442df84194c7

SHA256
2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8

SHA512
800e61e0ca304d84a8da9ffd056ccec3c255c8e731f8f5d08f95b70aee65fbace7b6dff9faa0fc6ee0721da8f08cc91ecf14793ef150143dee68dff492bbcacf

Download Submit
C:\Users\Admin\AppData\Local\Temp\NFKA878.exe
MD5
b9e7cdd63db7ff765efeaabd0a85ca59

SHA1
7e300cb3e4dc52eaff8dc082c687442df84194c7

SHA256
2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8

SHA512
800e61e0ca304d84a8da9ffd056ccec3c255c8e731f8f5d08f95b70aee65fbace7b6dff9faa0fc6ee0721da8f08cc91ecf14793ef150143dee68dff492bbcacf

Download Submit
C:\Users\Admin\AppData\Local\Temp\NFKA878.exe
MD5
b9e7cdd63db7ff765efeaabd0a85ca59

SHA1
7e300cb3e4dc52eaff8dc082c687442df84194c7

SHA256
2775f0156a394e76f16441e1a91c877323ef92d731370c87bbafb1481843b8f8

SHA512
800e61e0ca304d84a8da9ffd056ccec3c255c8e731f8f5d08f95b70aee65fbace7b6dff9faa0fc6ee0721da8f08cc91ecf14793ef150143dee68dff492bbcacf

Download Submit
memory/220-132-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/220-133-0x00000000001C0000-0x00000000001D5000-memory.dmp

Filesize
84KB

Download
memory/624-141-0x000001C06F590000-0x000001C06F5A0000-memory.dmp

Filesize
64KB

Download
memory/624-143-0x000001C072210000-0x000001C072214000-memory.dmp

Filesize
16KB

Download
memory/624-142-0x000001C06FCE0000-0x000001C06FCF0000-memory.dmp

Filesize
64KB

Download
memory/1836-131-0x00000000001E0000-0x00000000001F5000-memory.dmp

Filesize
84KB

Download
memory/1836-130-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/3780-136-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/3780-137-0x00000000001C0000-0x00000000001D5000-memory.dmp

Filesize
84KB

Download
memory/4908-140-0x00000000001C0000-0x00000000001D5000-memory.dmp

Filesize
84KB

Download
memory/4908-139-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads