AutoUpdateReplaceMe
CheckProvisioningSvc
ExecInjected
InjectPID
InjectProcessName
MsiTrackStart
MsiTrackStop
MyRegSaveKeyExRundll
UninjectPID
UninjectProcessName
Static task
static1
Behavioral task
behavioral1
Sample
c6120104db81ace4f3c29a810a1bde466459066991684bfafe3facc8b8c90bd3.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c6120104db81ace4f3c29a810a1bde466459066991684bfafe3facc8b8c90bd3.dll
Resource
win10v2004-20220414-en
Target
c6120104db81ace4f3c29a810a1bde466459066991684bfafe3facc8b8c90bd3
Size
624.1MB
MD5
98024699cca2cc183b43ea7e2725da68
SHA1
8f5510475c4a2e4c7748e64141f21c3388230b67
SHA256
c6120104db81ace4f3c29a810a1bde466459066991684bfafe3facc8b8c90bd3
SHA512
12358b5736252a5c42c19ba606e35501676429b0826aab6b113e232cb8291f2bc22f72ef1e5ea214a365ea5f9280e11e101cebdb99c8fdbe527ae136d4999ccf
SSDEEP
6291456:PcUXxXlMHTxYlvg3N2f9m+Rw4+Oih2wfiGbvnX6hov:EUZmH1YBg3NsbRdw2wftP
Processes:
resource | yara_rule |
---|---|
sample | BazarBackdoorVar3 |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetMappedFileNameW
GetModuleInformation
getpeername
WSAAddressToStringW
WSAGetLastError
UnmapViewOfFile
WaitForSingleObjectEx
CreateFileMappingW
OpenFileMappingW
LoadLibraryW
GetFileSize
SetFilePointer
OutputDebugStringW
WriteFile
FlushFileBuffers
DeleteFileW
SetEndOfFile
FlushViewOfFile
GetSystemInfo
GetSystemTime
SetFileAttributesW
EnumResourceNamesW
LoadLibraryExW
LocalAlloc
FindFirstFileW
FreeLibrary
GetSystemDirectoryW
GetWindowsDirectoryW
ReadFile
GetFileSizeEx
GetCurrentProcess
SystemTimeToFileTime
GetCommandLineW
CreateDirectoryW
FormatMessageA
SetFileTime
WaitNamedPipeW
OpenProcess
WideCharToMultiByte
CopyFileW
ReadProcessMemory
FormatMessageW
GetVersionExW
GetModuleFileNameW
GetTempPathW
GetLongPathNameW
GetLocalTime
RemoveDirectoryW
SetNamedPipeHandleState
VirtualQueryEx
VirtualProtectEx
VirtualAllocEx
WriteProcessMemory
TerminateProcess
IsWow64Process
VirtualProtect
SetEvent
CreateEventW
OpenEventW
CreateThread
GetFullPathNameW
GetFullPathNameA
CreateFileA
SetFilePointerEx
QueryPerformanceCounter
InterlockedCompareExchange
UnlockFile
LockFile
UnlockFileEx
GetSystemTimeAsFileTime
GetFileAttributesA
HeapCreate
HeapValidate
LockFileEx
MapViewOfFile
LoadLibraryA
GetDiskFreeSpaceA
GetFileAttributesExW
OutputDebugStringA
GetVersionExA
GetTempPathA
AreFileApisANSI
DeleteFileA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentDirectoryW
GetThreadContext
ResumeThread
SetCurrentDirectoryW
VirtualFree
FlushInstructionCache
VirtualAlloc
InterlockedIncrement
InterlockedDecrement
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
TlsSetValue
GetModuleHandleA
TlsAlloc
GetModuleFileNameA
GetVersion
SetEnvironmentVariableA
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
UnhandledExceptionFilter
RtlUnwind
GetStdHandle
TlsFree
lstrlenW
lstrlenA
lstrcpyW
lstrcpyA
lstrcmpA
lstrcatW
WaitForMultipleObjects
VirtualQuery
TerminateThread
SetThreadPriority
ReleaseSemaphore
LoadLibraryExA
GetExitCodeThread
GetCurrentThread
ExitThread
DuplicateHandle
DeviceIoControl
CreateSemaphoreA
CreateProcessA
CreatePipe
CreateMutexA
CreateFileMappingA
CreateEventA
IsDebuggerPresent
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStartupInfoW
SetUnhandledExceptionFilter
GetCPInfo
GetModuleHandleExW
IsProcessorFeaturePresent
GetStringTypeW
EncodePointer
QueryDosDeviceW
GetLogicalDrives
ExpandEnvironmentStringsW
ReleaseMutex
GetFileAttributesW
GetTickCount
GetDriveTypeW
TlsGetValue
CreateMutexW
LocalFree
GetCurrentProcessId
GetCurrentThreadId
ProcessIdToSessionId
EnterCriticalSection
MoveFileW
GetProcAddress
SetLastError
OpenMutexW
MultiByteToWideChar
CreateFileW
LeaveCriticalSection
Sleep
InitializeCriticalSection
GetModuleHandleW
GetEnvironmentVariableW
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
CloseHandle
DeleteCriticalSection
FindNextFileW
DecodePointer
LockResource
FindClose
HeapSize
GetLastError
RaiseException
GetExitCodeProcess
HeapDestroy
SizeofResource
InitializeCriticalSectionAndSpinCount
GetProcessHeap
FindFirstFileExW
WaitForSingleObject
HeapFree
SetEnvironmentVariableW
HeapAlloc
CreateProcessW
LoadResource
FindResourceW
FindResourceExW
HeapReAlloc
ExitProcess
GetACP
GetOEMCP
GetFileType
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
SetStdHandle
WriteConsoleW
GetDiskFreeSpaceW
GetThreadLocale
EnumWindows
GetThreadDesktop
DispatchMessageA
CloseDesktop
MessageBoxW
wsprintfW
GetUserObjectInformationA
MsgWaitForMultipleObjects
OpenInputDesktop
PeekMessageA
TranslateMessage
GetWindowThreadProcessId
WaitForInputIdle
MessageBoxA
PostMessageW
GetWindowTextW
RegOpenKeyExA
RegSetValueExA
RegQueryValueW
RegOpenKeyW
AdjustTokenPrivileges
RegEnumKeyExW
RegSetKeySecurity
FreeSid
SetSecurityDescriptorOwner
AllocateAndInitializeSid
LookupPrivilegeValueW
SetNamedSecurityInfoW
RegQueryInfoKeyW
EqualSid
GetTokenInformation
GetUserNameW
OpenProcessToken
RegEnumKeyW
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryValueExW
RegCreateKeyW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegFlushKey
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
GetSecurityDescriptorSacl
RegOpenKeyExW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyExW
RegDeleteValueA
LookupPrivilegeValueA
GetKernelObjectSecurity
RegQueryValueExA
CLSIDFromString
StringFromCLSID
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance
GetClassFile
SHParseDisplayName
FindExecutableW
CommandLineToArgvW
ShellExecuteExW
SysAllocStringLen
SysReAllocStringLen
SysFreeString
AutoUpdateReplaceMe
CheckProvisioningSvc
ExecInjected
InjectPID
InjectProcessName
MsiTrackStart
MsiTrackStop
MyRegSaveKeyExRundll
UninjectPID
UninjectProcessName
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ