Analysis
-
max time kernel
600s -
max time network
603s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
25-10-2022 14:49
General
-
Target
1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe
-
Size
580KB
-
MD5
b7d245ea334e2c1818cb757d7ef1f592
-
SHA1
c7411c8440593fac4b576b3d89504bf94b04ed1d
-
SHA256
1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b
-
SHA512
daf198057de8563b81014619308a405455a2a12b6dd0f9c02042614d10a7c6a4a190f610634089d96b141f710e19fd3627cdfa70f133e4d54078ad6bf3870acb
-
SSDEEP
6144:OJu7yDrEe9+FHM1sYr0JrU4ev9ZOh2At15jUR2EOjvktrYMZBxQTSAfGKEw:OJvD/Ys1l0JfW9H8C25jvMDZBxQ
Malware Config
Signatures
-
BazarBackdoor 64 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe"C:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe"1⤵
- BazarBackdoor
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exeC:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe {1D2309A1-135F-42EF-B0DA-31D890EB3B03}1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3916-132-0x0000000003D30000-0x0000000003D60000-memory.dmpFilesize
192KB
-
memory/3916-139-0x00000000020B0000-0x00000000020DB000-memory.dmpFilesize
172KB
-
memory/4212-140-0x0000000002220000-0x0000000002250000-memory.dmpFilesize
192KB