79ec3c471bfe90cf21f5d6da8bea68a7f66b1f4c5b320bfcf8d76ae7ed1c2089

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2024 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3ed9bb26fddbeaeb0e33982f826da25.exe
Size

627KB
MD5

d3ed9bb26fddbeaeb0e33982f826da25
SHA1

4d43b2ad4c3501cb1fea782850dd6a87972dac19
SHA256

79ec3c471bfe90cf21f5d6da8bea68a7f66b1f4c5b320bfcf8d76ae7ed1c2089
SHA512

def18a822a90083779c7517aec900dfd0a648762db1665a6be925c7fb36181e5b76be8bcf1d95247fa4d1b1ca6283f1e92e7c394328a272e47b6afe7fe94ce72
SSDEEP

12288:raNIVAemT8EFM/HSABV1VcOpxgVJdLGbnSQ0QK6q/y8PcvJNl:rqSiTzFMKaV13HtbSQXK6Hm2JN

Score

10^/10

persistence trojan

Malware Config

Signatures

Detects BazaLoader malware 14 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

Processes:

resource	yara_rule
behavioral2/memory/548-4-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader
behavioral2/memory/548-5-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader
behavioral2/memory/548-7-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader
behavioral2/memory/548-8-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader
behavioral2/memory/548-9-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader
behavioral2/memory/548-11-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader
behavioral2/memory/548-12-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader
behavioral2/memory/548-13-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader
behavioral2/memory/548-14-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader
behavioral2/memory/548-15-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader
behavioral2/memory/548-16-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader
behavioral2/memory/548-17-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader
behavioral2/memory/548-18-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader
behavioral2/memory/548-19-0x0000000000400000-0x00000000004A3000-memory.dmp	BazaLoader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d3ed9bb26fddbeaeb0e33982f826da25.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "c:\\windows\\system\\svchost.exe"	d3ed9bb26fddbeaeb0e33982f826da25.exe

Drops file in Windows directory 2 IoCs

Processes:

d3ed9bb26fddbeaeb0e33982f826da25.exe

description	ioc	process
File created	C:\Windows\System\svchost.exe	d3ed9bb26fddbeaeb0e33982f826da25.exe
File opened for modification	C:\Windows\System\svchost.exe	d3ed9bb26fddbeaeb0e33982f826da25.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

d3ed9bb26fddbeaeb0e33982f826da25.exe

pid process

548 d3ed9bb26fddbeaeb0e33982f826da25.exe

pid	process
548	d3ed9bb26fddbeaeb0e33982f826da25.exe

C:\Users\Admin\AppData\Local\Temp\d3ed9bb26fddbeaeb0e33982f826da25.exe
"C:\Users\Admin\AppData\Local\Temp\d3ed9bb26fddbeaeb0e33982f826da25.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:548

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-0-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/548-4-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/548-5-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/548-6-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/548-7-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/548-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/548-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/548-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/548-12-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/548-13-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/548-14-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/548-15-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/548-16-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/548-17-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/548-18-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/548-19-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download