Analysis

  • max time kernel
    143s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    10-05-2022 17:48

General

  • Target

    9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33.exe

  • Size

    156KB

  • MD5

    76b0f0d39f02744dd1937fe7688807d8

  • SHA1

    64cfa7352be82723e11282099975635f33fe7eb5

  • SHA256

    9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33

  • SHA512

    b2eca7e0282f91180ab5f351e8e7eb74bea787976cadfd7e41b5b88147addef9d15cadd1a03070fa83cb18af05e17cc695d7ed3a193c665b217bd91077d04503

Malware Config

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

  • Tries to connect to .bazar domain 1 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33.exe
    "C:\Users\Admin\AppData\Local\Temp\9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33.exe"
    1⤵
      PID:1728

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1728-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp
      Filesize

      8KB