Overview

overview

10

Static

static

10

c55f897999...e3.exe

windows7-x64

10

c55f897999...e3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    584s
  • max time network
    598s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2022 21:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c55f8979995df82555d66f6b197b0fbcb8fe30b431ff9760deae6927a584b9e3.exe

  • Size

    2.9MB

  • MD5

    b3b2333fa8195ad7003b6b3624ec7271

  • SHA1

    da702e36ccf5519831fec27904571c09cb1c200f

  • SHA256

    c55f8979995df82555d66f6b197b0fbcb8fe30b431ff9760deae6927a584b9e3

  • SHA512

    1df2210c4a30176aa03baae8b2145fedf65c50b41f49fcd050727339303f4ef56acc814d47ea429cb39b2c863e9f8dea5063ee23cfb98a7285f6cb3d315d2e53

  • SSDEEP

    6144:pMjYlrdBoHRDl02h/1uO5/hlK7wDQhhJYaQ:pMjUdBoHRD/lg4/PlDEfYa

Score
10/10
bazarbackdoorbackdoor

Malware Config

Signatures

  • BazarBackdoor 64 IoCs

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

    backdoorbazarbackdoor
  • Tries to connect to .bazar domain 64 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c55f8979995df82555d66f6b197b0fbcb8fe30b431ff9760deae6927a584b9e3.exe
    "C:\Users\Admin\AppData\Local\Temp\c55f8979995df82555d66f6b197b0fbcb8fe30b431ff9760deae6927a584b9e3.exe"
    1⤵
      PID:1920

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads