Analysis
-
max time kernel
4294215s -
max time network
179s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
19-03-2022 23:35
Static task
static1
Behavioral task
behavioral1
Sample
5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe
Resource
win10v2004-en-20220113
General
-
Target
5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe
-
Size
312KB
-
MD5
2044ffa237db8f249d7d4d29c56e7d21
-
SHA1
6d94758409cdba8b564fb42377397f90b1ebb0c7
-
SHA256
5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49
-
SHA512
bfb0bc83dab159c75677b13ec5a4e3fba57cc9f70cd5b712d888b7ce57f132b899d87e0e3c88eaa5c143c82a69b5fcb8b45f4c4b99a23f98e321f32b780563df
Malware Config
Extracted
bazarloader
54.193.186.118
13.57.15.8
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1632-54-0x0000000000350000-0x0000000000374000-memory.dmp BazarLoaderVar1 behavioral1/memory/1632-58-0x0000000180000000-0x0000000180022000-memory.dmp BazarLoaderVar1 behavioral1/memory/1632-62-0x0000000000320000-0x0000000000342000-memory.dmp BazarLoaderVar1 -
Executes dropped EXE 2 IoCs
Processes:
C0NA3AF.exeC0NA3AF.exepid process 1600 C0NA3AF.exe 1648 C0NA3AF.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.execmd.exepid process 972 cmd.exe 2024 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
C0NA3AF.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\CJTKN1HW = "cmd.exe /c reg.exe add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v G0HLPMPDNJK /t REG_SZ /d \"\\\"C:\\Users\\Admin\\AppData\\Local\\Temp\\C0NA3AF.exe\\\" I5ILPL\" & start \"H\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\C0NA3AF.exe\" I5ILPL" C0NA3AF.exe -
Drops file in Windows directory 4 IoCs
Processes:
5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exeC0NA3AF.exeC0NA3AF.exedescription ioc process File opened for modification C:\Windows\explorer.exe 5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe File opened for modification C:\Windows\explorer.exe 5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe File opened for modification C:\Windows\explorer.exe C0NA3AF.exe File opened for modification C:\Windows\explorer.exe C0NA3AF.exe -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 840 PING.EXE 1976 PING.EXE 1004 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exepid process 1632 5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.execmd.exe5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.execmd.exeC0NA3AF.execmd.exedescription pid process target process PID 1632 wrote to memory of 1668 1632 5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe cmd.exe PID 1632 wrote to memory of 1668 1632 5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe cmd.exe PID 1632 wrote to memory of 1668 1632 5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe cmd.exe PID 1668 wrote to memory of 1976 1668 cmd.exe PING.EXE PID 1668 wrote to memory of 1976 1668 cmd.exe PING.EXE PID 1668 wrote to memory of 1976 1668 cmd.exe PING.EXE PID 1668 wrote to memory of 1436 1668 cmd.exe 5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe PID 1668 wrote to memory of 1436 1668 cmd.exe 5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe PID 1668 wrote to memory of 1436 1668 cmd.exe 5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe PID 1436 wrote to memory of 972 1436 5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe cmd.exe PID 1436 wrote to memory of 972 1436 5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe cmd.exe PID 1436 wrote to memory of 972 1436 5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe cmd.exe PID 972 wrote to memory of 1004 972 cmd.exe PING.EXE PID 972 wrote to memory of 1004 972 cmd.exe PING.EXE PID 972 wrote to memory of 1004 972 cmd.exe PING.EXE PID 972 wrote to memory of 1600 972 cmd.exe C0NA3AF.exe PID 972 wrote to memory of 1600 972 cmd.exe C0NA3AF.exe PID 972 wrote to memory of 1600 972 cmd.exe C0NA3AF.exe PID 1600 wrote to memory of 2024 1600 C0NA3AF.exe cmd.exe PID 1600 wrote to memory of 2024 1600 C0NA3AF.exe cmd.exe PID 1600 wrote to memory of 2024 1600 C0NA3AF.exe cmd.exe PID 2024 wrote to memory of 840 2024 cmd.exe PING.EXE PID 2024 wrote to memory of 840 2024 cmd.exe PING.EXE PID 2024 wrote to memory of 840 2024 cmd.exe PING.EXE PID 2024 wrote to memory of 1648 2024 cmd.exe C0NA3AF.exe PID 2024 wrote to memory of 1648 2024 cmd.exe C0NA3AF.exe PID 2024 wrote to memory of 1648 2024 cmd.exe C0NA3AF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe"C:\Users\Admin\AppData\Local\Temp\5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe TRT92⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 8.8.8.8 -n 23⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exeC:\Users\Admin\AppData\Local\Temp\5e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49.exe TRT93⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\C0NA3AF.exe YIIY44⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 8.8.8.8 -n 25⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\C0NA3AF.exeC:\Users\Admin\AppData\Local\Temp\C0NA3AF.exe YIIY45⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\C0NA3AF.exe I5ILPL6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 8.8.8.8 -n 27⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\C0NA3AF.exeC:\Users\Admin\AppData\Local\Temp\C0NA3AF.exe I5ILPL7⤵
- Executes dropped EXE
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\C0NA3AF.exeMD5
2044ffa237db8f249d7d4d29c56e7d21
SHA16d94758409cdba8b564fb42377397f90b1ebb0c7
SHA2565e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49
SHA512bfb0bc83dab159c75677b13ec5a4e3fba57cc9f70cd5b712d888b7ce57f132b899d87e0e3c88eaa5c143c82a69b5fcb8b45f4c4b99a23f98e321f32b780563df
-
C:\Users\Admin\AppData\Local\Temp\C0NA3AF.exeMD5
2044ffa237db8f249d7d4d29c56e7d21
SHA16d94758409cdba8b564fb42377397f90b1ebb0c7
SHA2565e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49
SHA512bfb0bc83dab159c75677b13ec5a4e3fba57cc9f70cd5b712d888b7ce57f132b899d87e0e3c88eaa5c143c82a69b5fcb8b45f4c4b99a23f98e321f32b780563df
-
\Users\Admin\AppData\Local\Temp\C0NA3AF.exeMD5
2044ffa237db8f249d7d4d29c56e7d21
SHA16d94758409cdba8b564fb42377397f90b1ebb0c7
SHA2565e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49
SHA512bfb0bc83dab159c75677b13ec5a4e3fba57cc9f70cd5b712d888b7ce57f132b899d87e0e3c88eaa5c143c82a69b5fcb8b45f4c4b99a23f98e321f32b780563df
-
\Users\Admin\AppData\Local\Temp\C0NA3AF.exeMD5
2044ffa237db8f249d7d4d29c56e7d21
SHA16d94758409cdba8b564fb42377397f90b1ebb0c7
SHA2565e169256d9b7ff85c9b2e2489945cb9deb66f44fecad16a7bfb36d3b31c2ab49
SHA512bfb0bc83dab159c75677b13ec5a4e3fba57cc9f70cd5b712d888b7ce57f132b899d87e0e3c88eaa5c143c82a69b5fcb8b45f4c4b99a23f98e321f32b780563df
-
memory/1632-54-0x0000000000350000-0x0000000000374000-memory.dmpFilesize
144KB
-
memory/1632-58-0x0000000180000000-0x0000000180022000-memory.dmpFilesize
136KB
-
memory/1632-62-0x0000000000320000-0x0000000000342000-memory.dmpFilesize
136KB