Analysis
-
max time kernel
152s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
20-03-2022 03:26
Static task
static1
Behavioral task
behavioral1
Sample
30b2922c78a07dcd65a6f93886e7efcd6c3c883c70c2dc5f37cf41e50f240903.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
30b2922c78a07dcd65a6f93886e7efcd6c3c883c70c2dc5f37cf41e50f240903.exe
Resource
win10v2004-en-20220113
General
-
Target
30b2922c78a07dcd65a6f93886e7efcd6c3c883c70c2dc5f37cf41e50f240903.exe
-
Size
574KB
-
MD5
f7079cd6f7bb70b8a341af27c62be1aa
-
SHA1
d29014883d17739d350d5a85306fb8dff550661e
-
SHA256
30b2922c78a07dcd65a6f93886e7efcd6c3c883c70c2dc5f37cf41e50f240903
-
SHA512
53b6defd951e3a8fc0a55817d5c1d728b29cadaeed22d5a357bb5aae261d0e2709aef73e8588e0e8abee15cc048746ec48e1086d48e95fe3a919730acfc1d37d
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3024-130-0x0000000002030000-0x0000000002089000-memory.dmp BazarBackdoorVar3 behavioral2/memory/3024-134-0x0000000002500000-0x0000000002558000-memory.dmp BazarBackdoorVar3 behavioral2/memory/3024-139-0x0000000001FD0000-0x0000000002026000-memory.dmp BazarBackdoorVar3 -
Bazar/Team9 Loader payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3024-130-0x0000000002030000-0x0000000002089000-memory.dmp BazarLoaderVar3 behavioral2/memory/3024-134-0x0000000002500000-0x0000000002558000-memory.dmp BazarLoaderVar3 behavioral2/memory/3024-139-0x0000000001FD0000-0x0000000002026000-memory.dmp BazarLoaderVar3