Analysis
-
max time kernel
4294211s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
19-03-2022 14:35
General
-
Target
102dca8d268dbbba33770459009d4d67e0d714b44523c28fce57ee83fe186a31.exe
-
Size
285KB
-
MD5
e018926f81bf4599dedb4ae1696689b1
-
SHA1
32ccd73e3acf5ea7f78cf4f619d717d404660275
-
SHA256
102dca8d268dbbba33770459009d4d67e0d714b44523c28fce57ee83fe186a31
-
SHA512
06b46d9fd4970b946f42d05c4f83e7a2dae66fdc21ce0243f0bb51a714dd800de5b82667fd145d10c353dc7c82c1213bda510ce9bdb5b44d825331da9a807125
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 3 IoCs
-
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\102dca8d268dbbba33770459009d4d67e0d714b44523c28fce57ee83fe186a31.exe"C:\Users\Admin\AppData\Local\Temp\102dca8d268dbbba33770459009d4d67e0d714b44523c28fce57ee83fe186a31.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1616-54-0x000007FEF6B71000-0x000007FEF6B73000-memory.dmpFilesize
8KB
-
memory/1616-55-0x0000000000260000-0x000000000027C000-memory.dmpFilesize
112KB
-
memory/1616-59-0x0000000180000000-0x000000018001A000-memory.dmpFilesize
104KB
-
memory/1616-63-0x0000000000240000-0x000000000025A000-memory.dmpFilesize
104KB