Overview

overview

10

Static

static

7dd0c77804...09.exe

windows7_x64

10

7dd0c77804...09.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7dd0c77804f7369c80257091004095f4f3bbd43ab7bfe413bdb5f01abf6b2a09

  • Size

    603KB

  • Sample

    220320-g96wvsaceq

  • MD5

    fe0c4a65b6460d9163d05815ff3dc40d

  • SHA1

    3b98ae02a0d9e131790cddb1ca22fae4b51219bb

  • SHA256

    7dd0c77804f7369c80257091004095f4f3bbd43ab7bfe413bdb5f01abf6b2a09

  • SHA512

    c63c86d81cd802259f701184bb7e502acfa34f37e01cd1a7c5aee366e6e33aacd271d226b570c1e83fb84e512731f9118fe8e4289a1e2169005a48a21dad2c3b

Score
10/10
bazarloaderdropperloaderpersistence

Malware Config

Targets

    • Target

      7dd0c77804f7369c80257091004095f4f3bbd43ab7bfe413bdb5f01abf6b2a09

    • Size

      603KB

    • MD5

      fe0c4a65b6460d9163d05815ff3dc40d

    • SHA1

      3b98ae02a0d9e131790cddb1ca22fae4b51219bb

    • SHA256

      7dd0c77804f7369c80257091004095f4f3bbd43ab7bfe413bdb5f01abf6b2a09

    • SHA512

      c63c86d81cd802259f701184bb7e502acfa34f37e01cd1a7c5aee366e6e33aacd271d226b570c1e83fb84e512731f9118fe8e4289a1e2169005a48a21dad2c3b

    Score
    10/10
    bazarloaderdropperloaderpersistence

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks