Overview

overview

10

Static

static

7

update.exe

windows7-x64

10

update.exe

windows10-2004-x64

10

Resubmissions

14-09-2022 17:50

220914-we3y2sefgl 10

09-09-2022 14:03

220909-rc586sgce7 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    update.exe

  • Size

    7.6MB

  • Sample

    220914-we3y2sefgl

  • MD5

    38d2e3ad694e5221b828441d82d6172d

  • SHA1

    02e58b9fccb8fb01339c5f24aa26d656db389bcd

  • SHA256

    3e8f5d33715f69f5297ca2750d9a9ed491749f009455217626b16f3b268dbcaf

  • SHA512

    e96ca478921cb272f3b246e83b1b7a695638fb001dd05348ef4861b1842a2c49bccc4864867f99439e262fa983202056c196a2508597e2c83f4350683d5e6ea8

  • SSDEEP

    196608:Bry4z4fbI39lVt1nRMT2cZlpbhQaQ9HQhMWuKej4ifJj/Fv4wkB1S:44z4MD1nS2YlUz9wTuD5/Fv4wcM

Score
10/10
bazarbackdoorbackdoorevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      update.exe

    • Size

      7.6MB

    • MD5

      38d2e3ad694e5221b828441d82d6172d

    • SHA1

      02e58b9fccb8fb01339c5f24aa26d656db389bcd

    • SHA256

      3e8f5d33715f69f5297ca2750d9a9ed491749f009455217626b16f3b268dbcaf

    • SHA512

      e96ca478921cb272f3b246e83b1b7a695638fb001dd05348ef4861b1842a2c49bccc4864867f99439e262fa983202056c196a2508597e2c83f4350683d5e6ea8

    • SSDEEP

      196608:Bry4z4fbI39lVt1nRMT2cZlpbhQaQ9HQhMWuKej4ifJj/Fv4wkB1S:44z4MD1nS2YlUz9wTuD5/Fv4wcM

    Score
    10/10
    bazarbackdoorbackdoorevasionthemidatrojanpersistence

    • BazarBackdoor

      Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

      backdoorbazarbackdoor

    • Bazar/Team9 Backdoor payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Nirsoft

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Impair Defenses

1
T1562

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks