Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17-04-2022 16:35
Static task
static1
Behavioral task
behavioral1
Sample
b200c43ddc7ed92dddd0cd01ab7a7f785618013b9eaa85aa3da0a377db7d2614.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b200c43ddc7ed92dddd0cd01ab7a7f785618013b9eaa85aa3da0a377db7d2614.exe
Resource
win10v2004-20220414-en
General
-
Target
b200c43ddc7ed92dddd0cd01ab7a7f785618013b9eaa85aa3da0a377db7d2614.exe
-
Size
461KB
-
MD5
6744aa8b25616f7060b34933f29cb215
-
SHA1
86611fb1d7352b73f9206ffaad9d5651afbeb45a
-
SHA256
b200c43ddc7ed92dddd0cd01ab7a7f785618013b9eaa85aa3da0a377db7d2614
-
SHA512
d402aed51a6229b64f151851bffe5b3c5a402e501b4dc3854eb3700d69f6cff8bd9e4647588daa5c31683175ae722f0e9681bbd7498d160a4104a6e360cd4287
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4860-130-0x0000000000500000-0x0000000000521000-memory.dmp BazarLoaderVar1 behavioral2/memory/4860-134-0x0000000180000000-0x000000018001E000-memory.dmp BazarLoaderVar1 behavioral2/memory/4860-138-0x0000000000550000-0x000000000056D000-memory.dmp BazarLoaderVar1 behavioral2/memory/4860-142-0x00000000004E0000-0x00000000004FF000-memory.dmp BazarLoaderVar1 -
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
Processes:
flow ioc 52 dcegjldkggjp.bazar 130 ddehimdlghiq.bazar 177 bdfgilblhgip.bazar 311 ceggjkcmigjo.bazar 91 bdegjkblggjo.bazar 188 bdfgilblhgip.bazar 195 aegijmamiijq.bazar 242 dfegkkdnggko.bazar 259 afeiilangiip.bazar 288 ceggjkcmigjo.bazar 224 dfegkkdnggko.bazar 251 dfegkkdnggko.bazar 322 afehjlanghjp.bazar 103 ddehimdlghiq.bazar 118 ddehimdlghiq.bazar 282 afeiilangiip.bazar 321 afehjlanghjp.bazar 337 afehjlanghjp.bazar 355 dceijmdkgijq.bazar 58 dcegjldkggjp.bazar 109 ddehimdlghiq.bazar 137 ddegkmdlggkq.bazar 149 ddegkmdlggkq.bazar 166 bdfgilblhgip.bazar 243 dfegkkdnggko.bazar 253 afeiilangiip.bazar 204 aegijmamiijq.bazar 347 dceijmdkgijq.bazar 114 ddehimdlghiq.bazar 122 ddehimdlghiq.bazar 126 ddehimdlghiq.bazar 316 afehjlanghjp.bazar 145 ddegkmdlggkq.bazar 159 ddegkmdlggkq.bazar 164 bdfgilblhgip.bazar 214 aegijmamiijq.bazar 228 dfegkkdnggko.bazar 341 afehjlanghjp.bazar 295 ceggjkcmigjo.bazar 54 dcegjldkggjp.bazar 104 ddehimdlghiq.bazar 105 ddehimdlghiq.bazar 117 ddehimdlghiq.bazar 176 bdfgilblhgip.bazar 202 aegijmamiijq.bazar 245 dfegkkdnggko.bazar 302 ceggjkcmigjo.bazar 50 dcegjldkggjp.bazar 56 dcegjldkggjp.bazar 175 bdfgilblhgip.bazar 331 afehjlanghjp.bazar 340 afehjlanghjp.bazar 326 afehjlanghjp.bazar 80 bdegjkblggjo.bazar 161 ddegkmdlggkq.bazar 185 bdfgilblhgip.bazar 233 dfegkkdnggko.bazar 264 afeiilangiip.bazar 301 ceggjkcmigjo.bazar 315 afehjlanghjp.bazar 64 dcegjldkggjp.bazar 167 bdfgilblhgip.bazar 339 afehjlanghjp.bazar 163 bdfgilblhgip.bazar -
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 167.99.153.82 Destination IP 96.47.228.108 Destination IP 45.32.160.206 Destination IP 96.47.228.108 Destination IP 167.99.153.82 Destination IP 5.45.97.127 Destination IP 77.73.68.161 Destination IP 82.141.39.32 Destination IP 94.177.171.127 Destination IP 172.104.136.243 Destination IP 163.172.185.51 Destination IP 176.126.70.119 Destination IP 96.47.228.108 Destination IP 94.177.171.127 Destination IP 89.35.39.64 Destination IP 167.99.153.82 Destination IP 5.135.183.146 Destination IP 82.141.39.32 Destination IP 63.231.92.27 Destination IP 5.135.183.146 Destination IP 169.239.202.202 Destination IP 208.67.222.222 Destination IP 142.4.205.47 Destination IP 208.67.220.220 Destination IP 77.73.68.161 Destination IP 217.12.210.54 Destination IP 45.32.160.206 Destination IP 208.67.222.222 Destination IP 5.45.97.127 Destination IP 69.164.196.21 Destination IP 185.164.136.225 Destination IP 5.135.183.146 Destination IP 185.164.136.225 Destination IP 82.141.39.32 Destination IP 192.99.85.244 Destination IP 5.135.183.146 Destination IP 185.164.136.225 Destination IP 94.177.171.127 Destination IP 169.239.202.202 Destination IP 77.73.68.161 Destination IP 192.99.85.244 Destination IP 172.98.193.42 Destination IP 185.121.177.177 Destination IP 172.104.136.243 Destination IP 147.135.185.78 Destination IP 162.248.241.94 Destination IP 96.47.228.108 Destination IP 69.164.196.21 Destination IP 176.126.70.119 Destination IP 94.177.171.127 Destination IP 45.32.160.206 Destination IP 142.4.204.111 Destination IP 162.248.241.94 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 94.177.171.127 Destination IP 147.135.185.78 Destination IP 142.4.204.111 Destination IP 45.63.124.65 Destination IP 69.164.196.21 Destination IP 217.12.210.54 Destination IP 5.135.183.146 Destination IP 142.4.205.47 Destination IP 185.121.177.177 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b200c43ddc7ed92dddd0cd01ab7a7f785618013b9eaa85aa3da0a377db7d2614.exepid process 4860 b200c43ddc7ed92dddd0cd01ab7a7f785618013b9eaa85aa3da0a377db7d2614.exe 4860 b200c43ddc7ed92dddd0cd01ab7a7f785618013b9eaa85aa3da0a377db7d2614.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4860-130-0x0000000000500000-0x0000000000521000-memory.dmpFilesize
132KB
-
memory/4860-134-0x0000000180000000-0x000000018001E000-memory.dmpFilesize
120KB
-
memory/4860-138-0x0000000000550000-0x000000000056D000-memory.dmpFilesize
116KB
-
memory/4860-142-0x00000000004E0000-0x00000000004FF000-memory.dmpFilesize
124KB