Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
25-10-2022 14:32
General
-
Target
1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe
-
Size
580KB
-
MD5
b7d245ea334e2c1818cb757d7ef1f592
-
SHA1
c7411c8440593fac4b576b3d89504bf94b04ed1d
-
SHA256
1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b
-
SHA512
daf198057de8563b81014619308a405455a2a12b6dd0f9c02042614d10a7c6a4a190f610634089d96b141f710e19fd3627cdfa70f133e4d54078ad6bf3870acb
-
SSDEEP
6144:OJu7yDrEe9+FHM1sYr0JrU4ev9ZOh2At15jUR2EOjvktrYMZBxQTSAfGKEw:OJvD/Ys1l0JfW9H8C25jvMDZBxQ
Score
10/10
Malware Config
Signatures
-
BazarBackdoor 2 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Tries to connect to .bazar domain 1 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe"C:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe"1⤵
- BazarBackdoor
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exeC:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe {8F61E2C1-16BA-44C7-BE5E-8EB6137830B8}1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/544-132-0x0000000002100000-0x0000000002130000-memory.dmpFilesize
192KB
-
memory/544-139-0x0000000000610000-0x000000000063B000-memory.dmpFilesize
172KB
-
memory/4708-140-0x00000000020C0000-0x00000000020F0000-memory.dmpFilesize
192KB