Analysis
-
max time kernel
4294204s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
19-03-2022 11:49
General
-
Target
7978e198f7523d487e13a742101810d765c4ed191920d571ea51c99cc18eb795.exe
-
Size
576KB
-
MD5
8763f3f259a7f7fb8e9e91cd3d6491c7
-
SHA1
d56fb7bf84a483416810c4309ef720548422f6d6
-
SHA256
7978e198f7523d487e13a742101810d765c4ed191920d571ea51c99cc18eb795
-
SHA512
aa8ace0467c236ceacdcbd4627c518860f726d98128be2ec4cfa442cdf0f8a8f54770d34bf040450d179580743bd8f19904be187c706f295ab4d6e97a9b9c3cb
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 3 IoCs
-
Bazar/Team9 Loader payload 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7978e198f7523d487e13a742101810d765c4ed191920d571ea51c99cc18eb795.exe"C:\Users\Admin\AppData\Local\Temp\7978e198f7523d487e13a742101810d765c4ed191920d571ea51c99cc18eb795.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1216-54-0x000007FEF6131000-0x000007FEF6133000-memory.dmpFilesize
8KB
-
memory/1216-55-0x00000000004C0000-0x0000000000519000-memory.dmpFilesize
356KB
-
memory/1216-59-0x0000000180000000-0x0000000180058000-memory.dmpFilesize
352KB
-
memory/1216-64-0x0000000000230000-0x0000000000287000-memory.dmpFilesize
348KB