Analysis

  • max time kernel
    142s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25-04-2022 02:20

General

  • Target

    images.exe

  • Size

    290KB

  • MD5

    e28ae2f26a165ab891248f17b064f2e7

  • SHA1

    8ac67ed569b4675411c54ac05768eefff853854f

  • SHA256

    0b7eafb0e73e2bf0e0c6263824ffacbf4869f9121502264e5dc08d09183ae301

  • SHA512

    ba26ca25af0f1a5a5d4ec9c7fa1ba64e395d4c0a44b7803399df7dd50497addaa01ebf65d691c1f0a0a87462f0216aea60b9f4a6b3bffdc7c9743dc9e667c5b6

Malware Config

Extracted

Family

bazarloader

C2

144.217.50.242

5.39.63.103

94.140.113.53

185.163.45.95

reddew28c.bazar

bluehail.bazar

whitestorm9p.bazar

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\images.exe
    "C:\Users\Admin\AppData\Local\Temp\images.exe"
    1⤵
      PID:324

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/324-54-0x000007FFFFF90000-0x000007FFFFFAF000-memory.dmp
      Filesize

      124KB