Analysis

  • max time kernel
    600s
  • max time network
    602s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    25-10-2022 14:44

General

  • Target

    1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe

  • Size

    580KB

  • MD5

    b7d245ea334e2c1818cb757d7ef1f592

  • SHA1

    c7411c8440593fac4b576b3d89504bf94b04ed1d

  • SHA256

    1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b

  • SHA512

    daf198057de8563b81014619308a405455a2a12b6dd0f9c02042614d10a7c6a4a190f610634089d96b141f710e19fd3627cdfa70f133e4d54078ad6bf3870acb

  • SSDEEP

    6144:OJu7yDrEe9+FHM1sYr0JrU4ev9ZOh2At15jUR2EOjvktrYMZBxQTSAfGKEw:OJvD/Ys1l0JfW9H8C25jvMDZBxQ

Score
10/10

Malware Config

Signatures

  • BazarBackdoor 64 IoCs

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

  • Tries to connect to .bazar domain 64 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe
    "C:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe"
    1⤵
    • BazarBackdoor
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    PID:1132
  • C:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe
    C:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe {9AEA4D07-C71D-43DF-A9B7-C3C6D699A0AF}
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1252
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1876
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x170
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1748

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1132-54-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmp

      Filesize

      8KB

    • memory/1132-55-0x00000000003B0000-0x00000000003E0000-memory.dmp

      Filesize

      192KB

    • memory/1132-62-0x0000000000260000-0x000000000028B000-memory.dmp

      Filesize

      172KB

    • memory/1252-64-0x0000000002000000-0x0000000002030000-memory.dmp

      Filesize

      192KB