bazarbackdoor | 065602c5b079b14608165cf71314c34017fa767a9c863e2f4cb29bb1c3195c35

Analysis

max time kernel
286s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 21:38

Target

dl2.zip
Size

460KB
MD5

73ff2d6e4243f132fa8509cc2224a769
SHA1

6dd284977448acd43e84444397c6d9573e31274a
SHA256

065602c5b079b14608165cf71314c34017fa767a9c863e2f4cb29bb1c3195c35
SHA512

d76354357d52d9632fc1834bc1e23c49f55f16b2621cb9d61ad71cc959c7626f86e52213343469adbb4ced6e50e6bb927dbac2315cdbfb43412b6947badf17c1
SSDEEP

12288:nHmryUwHw0XQmwOUehCqd/lmwe7cfvDApjbk0Q:nHkRiVXQWlbfLCdQ

Score

10^/10

BazarBackdoor 3 IoCs

Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

description	flow	ioc	Process
Key created		\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Software\Microsoft\SystemCertificates\CA	dl2.exe
HTTP URL	63	https://31.214.240.203/api/v134	Process not Found
HTTP URL	100	https://195.123.240.6/api/v134	Process not Found

Tries to connect to .bazar domain 2 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

description	flow	ioc
HTTP URL	63	https://31.214.240.203/api/v134
HTTP URL	100	https://195.123.240.6/api/v134

Suspicious use of SetWindowsHookEx 4 IoCs

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\dl2.zip
1⤵
PID:772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4928

C:\Users\Admin\Desktop\dl2.exe
C:\Users\Admin\Desktop\dl2.exe {34249617-8160-4971-B9CD-DDB345F9843D}
1⤵
- Suspicious use of SetWindowsHookEx
PID:4484

C:\Users\Admin\Desktop\dl2.exe
C:\Users\Admin\Desktop\dl2.exe {34249617-8160-4971-B9CD-DDB345F9843D}
1⤵
- Suspicious use of SetWindowsHookEx
PID:1660

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:4308

C:\Users\Admin\Desktop\dl2.exe
"C:\Users\Admin\Desktop\dl2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2812

C:\Users\Admin\AppData\Local\Temp\dl2.zip

Filesize
460KB

MD5
73ff2d6e4243f132fa8509cc2224a769

SHA1
6dd284977448acd43e84444397c6d9573e31274a

SHA256
065602c5b079b14608165cf71314c34017fa767a9c863e2f4cb29bb1c3195c35

SHA512
d76354357d52d9632fc1834bc1e23c49f55f16b2621cb9d61ad71cc959c7626f86e52213343469adbb4ced6e50e6bb927dbac2315cdbfb43412b6947badf17c1

Download Submit
memory/1660-22-0x0000000000530000-0x0000000000630000-memory.dmp

Filesize
1024KB

Download
memory/1660-21-0x0000000002100000-0x0000000002130000-memory.dmp

Filesize
192KB

Download
memory/2812-32-0x0000000000650000-0x0000000000680000-memory.dmp

Filesize
192KB

Download
memory/2812-33-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/3660-2-0x0000000002110000-0x0000000002140000-memory.dmp

Filesize
192KB

Download
memory/3660-4-0x00000000005B0000-0x00000000006B0000-memory.dmp

Filesize
1024KB

Download
memory/3660-19-0x00000000005B0000-0x00000000006B0000-memory.dmp

Filesize
1024KB

Download
memory/4484-12-0x0000000000600000-0x0000000000700000-memory.dmp

Filesize
1024KB

Download
memory/4484-11-0x0000000002230000-0x0000000002260000-memory.dmp

Filesize
192KB

Download