Analysis
-
max time kernel
4294213s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
20-03-2022 03:26
Static task
static1
Behavioral task
behavioral1
Sample
30b2922c78a07dcd65a6f93886e7efcd6c3c883c70c2dc5f37cf41e50f240903.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
30b2922c78a07dcd65a6f93886e7efcd6c3c883c70c2dc5f37cf41e50f240903.exe
Resource
win10v2004-en-20220113
General
-
Target
30b2922c78a07dcd65a6f93886e7efcd6c3c883c70c2dc5f37cf41e50f240903.exe
-
Size
574KB
-
MD5
f7079cd6f7bb70b8a341af27c62be1aa
-
SHA1
d29014883d17739d350d5a85306fb8dff550661e
-
SHA256
30b2922c78a07dcd65a6f93886e7efcd6c3c883c70c2dc5f37cf41e50f240903
-
SHA512
53b6defd951e3a8fc0a55817d5c1d728b29cadaeed22d5a357bb5aae261d0e2709aef73e8588e0e8abee15cc048746ec48e1086d48e95fe3a919730acfc1d37d
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1520-55-0x00000000004A0000-0x00000000004F9000-memory.dmp BazarBackdoorVar3 behavioral1/memory/1520-59-0x0000000000500000-0x0000000000558000-memory.dmp BazarBackdoorVar3 behavioral1/memory/1520-64-0x0000000000240000-0x0000000000296000-memory.dmp BazarBackdoorVar3 -
Bazar/Team9 Loader payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1520-55-0x00000000004A0000-0x00000000004F9000-memory.dmp BazarLoaderVar3 behavioral1/memory/1520-59-0x0000000000500000-0x0000000000558000-memory.dmp BazarLoaderVar3 behavioral1/memory/1520-64-0x0000000000240000-0x0000000000296000-memory.dmp BazarLoaderVar3
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1520-54-0x000007FEF7B01000-0x000007FEF7B03000-memory.dmpFilesize
8KB
-
memory/1520-55-0x00000000004A0000-0x00000000004F9000-memory.dmpFilesize
356KB
-
memory/1520-59-0x0000000000500000-0x0000000000558000-memory.dmpFilesize
352KB
-
memory/1520-64-0x0000000000240000-0x0000000000296000-memory.dmpFilesize
344KB