Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 12:57
General
-
Target
c68fec389bc0d74b7d1d26ec422cfe59c082cbf961a411abcdba31ed4a6cdb74.exe
-
Size
461KB
-
MD5
9776a22caf580541c8231e35e06b8423
-
SHA1
84250f1c3b526a88b260c8d8112cc0e92a7f71fb
-
SHA256
c68fec389bc0d74b7d1d26ec422cfe59c082cbf961a411abcdba31ed4a6cdb74
-
SHA512
0e073f7f8b810af8d913fcefe4bff40180b25ddd6f2f78246a831b89eae39ffc7ff2f1398cb4dd22a0e2c95bfc157c78ced9f76a0b0f26353520a33afb2ab537
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
BazarBackdoor 2 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Loader payload 3 IoCs
-
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c68fec389bc0d74b7d1d26ec422cfe59c082cbf961a411abcdba31ed4a6cdb74.exe"C:\Users\Admin\AppData\Local\Temp\c68fec389bc0d74b7d1d26ec422cfe59c082cbf961a411abcdba31ed4a6cdb74.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2344-130-0x0000000002050000-0x0000000002073000-memory.dmpFilesize
140KB
-
memory/2344-134-0x0000000140000000-0x0000000140021000-memory.dmpFilesize
132KB
-
memory/2344-138-0x00000000004A0000-0x00000000004C1000-memory.dmpFilesize
132KB