Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-07-2022 09:43
General
-
Target
7f3bcbb3e8080ac75f7bba326a23c54f.exe
-
Size
479KB
-
MD5
7f3bcbb3e8080ac75f7bba326a23c54f
-
SHA1
e2cf8adac9d9860db7fff35dc0d9c94807b0f2dd
-
SHA256
3bc6fc23cef261ac74aa5b98d0c3ec9a4fb1ef3f6b850334d4df698a5fe1ec04
-
SHA512
da60459af98161122eac4830c9017d1161d8fb6c4c6f65c0abd0e40cc536131678810943fc4c048110f0a2e7be0bff7d9de0c00589aa6f8e61fefe99a872b966
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 3 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f3bcbb3e8080ac75f7bba326a23c54f.exe"C:\Users\Admin\AppData\Local\Temp\7f3bcbb3e8080ac75f7bba326a23c54f.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7f3bcbb3e8080ac75f7bba326a23c54f.exe"C:\Users\Admin\AppData\Local\Temp\7f3bcbb3e8080ac75f7bba326a23c54f.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1048-54-0x000007FEFC3E1000-0x000007FEFC3E3000-memory.dmpFilesize
8KB
-
memory/1048-55-0x0000000001DA0000-0x0000000001DC7000-memory.dmpFilesize
156KB
-
memory/1048-57-0x0000000001EC0000-0x0000000001EEF000-memory.dmpFilesize
188KB
-
memory/1048-65-0x0000000001DA0000-0x0000000001DC7000-memory.dmpFilesize
156KB
-
memory/1944-64-0x0000000000000000-mapping.dmp
-
memory/1944-69-0x0000000000260000-0x000000000028F000-memory.dmpFilesize
188KB