Resubmissions
14-07-2024 08:16
240714-j6aelavgkf 328-03-2024 15:44
240328-s6f2tahh81 315-02-2024 03:14
240215-drq6xafb7s 605-02-2024 16:35
240205-t3whrsebaq 305-02-2024 16:32
240205-t17g9aeagl 308-12-2023 22:35
231208-2hv1haegb3 331-10-2023 16:20
231031-ttf2qaba4t 1024-10-2023 18:54
231024-xkm1fsgg8z 1020-09-2023 14:18
230920-rl8qnagg4s 1023-08-2023 22:11
230823-139hyshd3w 10Analysis
-
max time kernel
1800s -
max time network
1804s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2023 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dl2.exe
Resource
win7-20230831-en
windows7-x64
31 signatures
1800 seconds
Behavioral task
behavioral2
Sample
dl2.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
6 signatures
1800 seconds
General
-
Target
dl2.exe
-
Size
849KB
-
MD5
c2055b7fbaa041d9f68b9d5df9b45edd
-
SHA1
e4bd443bd4ce9029290dcd4bb47cb1a01f3b1b06
-
SHA256
342f04c4720590c40d24078d46d9b19d8175565f0af460598171d58f5ffc48f3
-
SHA512
18905b75938b8af9468b1aa3ffbae796a139c2762e623aa6ffb9ec2b293dd04aa1f90d1ed5a7dbda7853795a3688e368121a134c7f63e527a8e5e7679301a1dc
-
SSDEEP
12288:A3RY3yNqMRTF4q2rxHn2ot/81xpNQyjUXlmoe7ufjHAtjXD7r2:A3RY3R24q+xn/8Xp2yOl5fzQ/2
Score
10/10
Malware Config
Signatures
-
BazarBackdoor 64 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
description flow ioc Process 102 zirabuo.bazar Process not Found 133 zirabuo.bazar Process not Found 136 zirabuo.bazar Process not Found 148 zirabuo.bazar Process not Found 152 zirabuo.bazar Process not Found 188 zirabuo.bazar Process not Found HTTP URL 33 https://31.214.240.203/api/v134 Process not Found 95 zirabuo.bazar Process not Found 192 zirabuo.bazar Process not Found 161 zirabuo.bazar Process not Found 183 zirabuo.bazar Process not Found 107 zirabuo.bazar Process not Found 120 zirabuo.bazar Process not Found 132 zirabuo.bazar Process not Found 147 zirabuo.bazar Process not Found 186 zirabuo.bazar Process not Found 91 zirabuo.bazar Process not Found 97 zirabuo.bazar Process not Found 190 zirabuo.bazar Process not Found 193 zirabuo.bazar Process not Found 151 zirabuo.bazar Process not Found 178 zirabuo.bazar Process not Found 116 zirabuo.bazar Process not Found 176 zirabuo.bazar Process not Found 180 zirabuo.bazar Process not Found 184 zirabuo.bazar Process not Found 187 zirabuo.bazar Process not Found 79 zirabuo.bazar Process not Found 96 zirabuo.bazar Process not Found 181 zirabuo.bazar Process not Found 189 zirabuo.bazar Process not Found 103 zirabuo.bazar Process not Found 168 zirabuo.bazar Process not Found 160 zirabuo.bazar Process not Found 166 zirabuo.bazar Process not Found 167 zirabuo.bazar Process not Found 78 zirabuo.bazar Process not Found 106 zirabuo.bazar Process not Found 185 zirabuo.bazar Process not Found HTTP URL 53 https://195.123.240.6/api/v134 Process not Found 90 zirabuo.bazar Process not Found 112 zirabuo.bazar Process not Found 179 zirabuo.bazar Process not Found 128 zirabuo.bazar Process not Found 156 zirabuo.bazar Process not Found Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\SystemCertificates\CA dl2.exe 111 zirabuo.bazar Process not Found 140 zirabuo.bazar Process not Found 86 zirabuo.bazar Process not Found 125 zirabuo.bazar Process not Found 137 zirabuo.bazar Process not Found 155 zirabuo.bazar Process not Found 172 zirabuo.bazar Process not Found 177 zirabuo.bazar Process not Found 182 zirabuo.bazar Process not Found 191 zirabuo.bazar Process not Found 82 zirabuo.bazar Process not Found 124 zirabuo.bazar Process not Found 162 zirabuo.bazar Process not Found 129 zirabuo.bazar Process not Found 142 zirabuo.bazar Process not Found 118 zirabuo.bazar Process not Found 119 zirabuo.bazar Process not Found 139 zirabuo.bazar Process not Found -
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
description flow ioc 141 zirabuo.bazar 155 zirabuo.bazar 79 zirabuo.bazar 120 zirabuo.bazar 133 zirabuo.bazar 184 zirabuo.bazar 132 zirabuo.bazar 167 zirabuo.bazar 177 zirabuo.bazar 152 zirabuo.bazar 179 zirabuo.bazar 77 zirabuo.bazar 83 zirabuo.bazar 106 zirabuo.bazar 174 zirabuo.bazar 190 zirabuo.bazar 180 zirabuo.bazar 181 zirabuo.bazar 191 zirabuo.bazar HTTP URL 53 https://195.123.240.6/api/v134 116 zirabuo.bazar 124 zirabuo.bazar 160 zirabuo.bazar 185 zirabuo.bazar 139 zirabuo.bazar 151 zirabuo.bazar 82 zirabuo.bazar 119 zirabuo.bazar 136 zirabuo.bazar 156 zirabuo.bazar 168 zirabuo.bazar 78 zirabuo.bazar 86 zirabuo.bazar 147 zirabuo.bazar 125 zirabuo.bazar 176 zirabuo.bazar 189 zirabuo.bazar 90 zirabuo.bazar 95 zirabuo.bazar 115 zirabuo.bazar 186 zirabuo.bazar 102 zirabuo.bazar 148 zirabuo.bazar 161 zirabuo.bazar 187 zirabuo.bazar 112 zirabuo.bazar 137 zirabuo.bazar 140 zirabuo.bazar 107 zirabuo.bazar 182 zirabuo.bazar 188 zirabuo.bazar 193 zirabuo.bazar 91 zirabuo.bazar 101 zirabuo.bazar 103 zirabuo.bazar 183 zirabuo.bazar 87 zirabuo.bazar 128 zirabuo.bazar 172 zirabuo.bazar 178 zirabuo.bazar 192 zirabuo.bazar 96 zirabuo.bazar 111 zirabuo.bazar 162 zirabuo.bazar -
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 89.35.39.64 Destination IP 188.165.200.156 Destination IP 162.248.241.94 Destination IP 185.121.177.177 Destination IP 51.255.48.78 Destination IP 146.185.176.36 Destination IP 81.2.241.148 Destination IP 142.4.204.111 Destination IP 104.37.195.178 Destination IP 185.121.177.177 Destination IP 66.70.211.246 Destination IP 146.185.176.36 Destination IP 178.17.170.179 Destination IP 82.196.9.45 Destination IP 91.217.137.37 Destination IP 163.53.248.170 Destination IP 81.2.241.148 Destination IP 92.222.97.145 Destination IP 169.239.202.202 Destination IP 89.35.39.64 Destination IP 162.248.241.94 Destination IP 217.12.210.54 Destination IP 147.135.185.78 Destination IP 185.164.136.225 Destination IP 159.89.249.249 Destination IP 51.254.25.115 Destination IP 192.52.166.110 Destination IP 185.117.154.144 Destination IP 46.101.70.183 Destination IP 128.52.130.209 Destination IP 192.52.166.110 Destination IP 63.231.92.27 Destination IP 81.2.241.148 Destination IP 31.171.251.118 Destination IP 82.196.9.45 Destination IP 163.53.248.170 Destination IP 163.172.185.51 Destination IP 51.254.25.115 Destination IP 217.12.210.54 Destination IP 81.2.241.148 Destination IP 92.222.97.145 Destination IP 51.255.211.146 Destination IP 96.47.228.108 Destination IP 144.76.133.38 Destination IP 130.255.78.223 Destination IP 188.165.200.156 Destination IP 51.254.25.115 Destination IP 5.45.97.127 Destination IP 82.141.39.32 Destination IP 139.59.23.241 Destination IP 69.164.196.21 Destination IP 104.37.195.178 Destination IP 185.164.136.225 Destination IP 139.59.208.246 Destination IP 63.231.92.27 Destination IP 91.217.137.37 Destination IP 159.89.249.249 Destination IP 158.69.239.167 Destination IP 45.71.112.70 Destination IP 212.24.98.54 Destination IP 31.171.251.118 Destination IP 51.255.211.146 Destination IP 167.99.153.82 Destination IP 185.121.177.177 -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 dl2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 dl2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 dl2.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1464 dl2.exe 60 dl2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dl2.exe"C:\Users\Admin\AppData\Local\Temp\dl2.exe"1⤵
- BazarBackdoor
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:1464
-
C:\Users\Admin\AppData\Local\Temp\dl2.exeC:\Users\Admin\AppData\Local\Temp\dl2.exe {F81D6D3E-8E01-47F7-9AC6-6A8B644C8E34}1⤵
- Suspicious use of SetWindowsHookEx
PID:60