Analysis
-
max time kernel
177s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-05-2022 16:33
Static task
static1
Behavioral task
behavioral1
Sample
412483d8630f27d160d9baf8f9d2b4deeb510d0f351ce684e7c0619d26f1cc29.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
412483d8630f27d160d9baf8f9d2b4deeb510d0f351ce684e7c0619d26f1cc29.exe
Resource
win10v2004-20220414-en
General
-
Target
412483d8630f27d160d9baf8f9d2b4deeb510d0f351ce684e7c0619d26f1cc29.exe
-
Size
5.7MB
-
MD5
4c41decf8b08f8d5bb5445cc37a7065b
-
SHA1
2c60eb30ac92c79746bf6cc75d718726031926b5
-
SHA256
412483d8630f27d160d9baf8f9d2b4deeb510d0f351ce684e7c0619d26f1cc29
-
SHA512
945860033f9909d54432e99b8376f6c723e9d4561db82b367bbd73171b06634011beb4539e8f83b91b6ffcd046e9b402aa7fc7fea7c22486746cb994f555a816
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4216-130-0x00000000001A0000-0x00000000001B9000-memory.dmp BazarLoaderVar1 behavioral2/memory/4216-134-0x0000000180000000-0x0000000180017000-memory.dmp BazarLoaderVar1 behavioral2/memory/4216-138-0x0000000000180000-0x0000000000196000-memory.dmp BazarLoaderVar1 -
Tries to connect to .bazar domain 32 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
Processes:
flow ioc 279 dcegjldjggjp.bazar 284 dcegjldjggjp.bazar 259 dcegjldjggjp.bazar 265 dcegjldjggjp.bazar 273 dcegjldjggjp.bazar 276 dcegjldjggjp.bazar 281 dcegjldjggjp.bazar 282 dcegjldjggjp.bazar 261 dcegjldjggjp.bazar 272 dcegjldjggjp.bazar 275 dcegjldjggjp.bazar 277 dcegjldjggjp.bazar 278 dcegjldjggjp.bazar 263 dcegjldjggjp.bazar 271 dcegjldjggjp.bazar 286 dcegjldjggjp.bazar 287 dcegjldjggjp.bazar 288 dcegjldjggjp.bazar 262 dcegjldjggjp.bazar 269 dcegjldjggjp.bazar 266 dcegjldjggjp.bazar 283 dcegjldjggjp.bazar 285 dcegjldjggjp.bazar 267 dcegjldjggjp.bazar 270 dcegjldjggjp.bazar 268 dcegjldjggjp.bazar 274 dcegjldjggjp.bazar 300 bdegjkbkggjo.bazar 260 dcegjldjggjp.bazar 264 dcegjldjggjp.bazar 258 dcegjldjggjp.bazar 280 dcegjldjggjp.bazar -
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 5.45.97.127 Destination IP 169.239.202.202 Destination IP 163.172.185.51 Destination IP 92.222.97.145 Destination IP 51.254.25.115 Destination IP 142.4.205.47 Destination IP 87.98.175.85 Destination IP 77.73.68.161 Destination IP 185.208.208.141 Destination IP 94.177.171.127 Destination IP 89.35.39.64 Destination IP 185.164.136.225 Destination IP 82.196.9.45 Destination IP 172.104.136.243 Destination IP 139.59.23.241 Destination IP 89.18.27.167 Destination IP 178.17.170.179 Destination IP 130.255.78.223 Destination IP 104.238.186.189 Destination IP 193.183.98.66 Destination IP 128.52.130.209 Destination IP 169.239.202.202 Destination IP 142.4.204.111 Destination IP 158.69.160.164 Destination IP 158.69.239.167 Destination IP 130.255.78.223 Destination IP 51.255.211.146 Destination IP 162.248.241.94 Destination IP 45.71.112.70 Destination IP 128.52.130.209 Destination IP 5.45.97.127 Destination IP 130.255.78.223 Destination IP 91.217.137.37 Destination IP 198.251.90.143 Destination IP 163.53.248.170 Destination IP 142.4.204.111 Destination IP 45.63.124.65 Destination IP 172.98.193.42 Destination IP 51.254.25.115 Destination IP 82.141.39.32 Destination IP 139.59.23.241 Destination IP 66.70.211.246 Destination IP 162.248.241.94 Destination IP 46.28.207.199 Destination IP 163.172.185.51 Destination IP 51.254.25.115 Destination IP 92.222.97.145 Destination IP 212.24.98.54 Destination IP 185.208.208.141 Destination IP 193.183.98.66 Destination IP 176.126.70.119 Destination IP 158.69.239.167 Destination IP 46.28.207.199 Destination IP 111.67.20.8 Destination IP 163.53.248.170 Destination IP 142.4.205.47 Destination IP 198.251.90.143 Destination IP 111.67.20.8 Destination IP 144.76.133.38 Destination IP 217.12.210.54 Destination IP 82.141.39.32 Destination IP 193.183.98.66 Destination IP 176.126.70.119 Destination IP 167.99.153.82 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
412483d8630f27d160d9baf8f9d2b4deeb510d0f351ce684e7c0619d26f1cc29.exepid process 4216 412483d8630f27d160d9baf8f9d2b4deeb510d0f351ce684e7c0619d26f1cc29.exe 4216 412483d8630f27d160d9baf8f9d2b4deeb510d0f351ce684e7c0619d26f1cc29.exe