Analysis
-
max time kernel
601s -
max time network
602s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-10-2022 21:56
General
-
Target
e77e27630277a31276539c379671f54095d6b735f0568a3c457ac6a189c4c5b4.exe
-
Size
288KB
-
MD5
fdffbfa1380ab1a0ee2e26ff1be432b1
-
SHA1
5a004286c5b97afd97beec4b1332777c494d6ff1
-
SHA256
e77e27630277a31276539c379671f54095d6b735f0568a3c457ac6a189c4c5b4
-
SHA512
36f8b7fafff7a8c23802358de537efe3a3de76d89db212c62ee9ce502c64cad7817c185e1cea8487214745e636c285476a0819f90fa397a29a25f56f3dbc59d9
-
SSDEEP
6144:5nHYYpyAFUkAVcUtJ9YR7qZmeN9CGSiVMryu1Y5IDfsz:RxpyoUz1Gdom7GSuMrdk
Score
10/10
Malware Config
Signatures
-
Bazar Loader 64 IoCs
Detected loader normally used to deploy BazarBackdoor malware.
-
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e77e27630277a31276539c379671f54095d6b735f0568a3c457ac6a189c4c5b4.exe"C:\Users\Admin\AppData\Local\Temp\e77e27630277a31276539c379671f54095d6b735f0568a3c457ac6a189c4c5b4.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3112-132-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/3112-136-0x0000000180000000-0x000000018002A000-memory.dmpFilesize
168KB
-
memory/3112-137-0x00000000001C0000-0x00000000001E4000-memory.dmpFilesize
144KB
-
memory/3112-138-0x0000000180000000-0x000000018002A000-memory.dmpFilesize
168KB