Overview

overview

10

Static

static

3

rt3ret3(3).exe

windows10-1703-x64

10

Analysis

  • max time kernel
    129s
  • max time network
    142s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27-03-2024 17:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    rt3ret3(3).exe

  • Size

    236KB

  • MD5

    efa4b2e7d7016a1f80efff5840de3a18

  • SHA1

    04606786daa6313867c7ada1f0c9c925d9b602fb

  • SHA256

    291c573996c647508544e8e21bd2764e6e4c834d53d6d2c8903a0001c783764b

  • SHA512

    11446166922efb329d547ce329fb3ed70a3a99c1c037533beaecefd16d4a67c9dc9201592b0428a06fd956e4bb5caf3f7997a86200792e3e29a041f0963b2ced

  • SSDEEP

    6144:NgsO6Xkm0RsQNCR/JG+z5nLGcKYp05dMgSsXMH7/wrtKHRAwrcKxN:7GRsQ6RLhLGO05dMgrXwTKtKxA5w

Score
10/10
bazarloaderdropperloader

Malware Config

Extracted

Family

bazarloader

C2

vacationinsydney2021.bazar

bestsightsofwildaustralia.bazar

sydneynewtours.bazar

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Bazar/Team9 Loader payload 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rt3ret3(3).exe
    "C:\Users\Admin\AppData\Local\Temp\rt3ret3(3).exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c ping 8.8.8.8 -n 2 & C:\Users\Admin\AppData\Local\Temp\rt3ret3(3).exe T4B3
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4724
      • C:\Windows\system32\PING.EXE
        ping 8.8.8.8 -n 2
        3⤵
        • Runs ping.exe
        PID:4816
  • C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\UseRedo.bmp"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3132
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
    1⤵
      PID:1500
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StartSearch.mid"
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3080
    • C:\Windows\System32\SystemSettingsBroker.exe
      C:\Windows\System32\SystemSettingsBroker.exe -Embedding
      1⤵
        PID:4560
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
        1⤵
          PID:1220
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k localservice -s SstpSvc
          1⤵
            PID:3548
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:712
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
            1⤵
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:1940
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s RasMan
            1⤵
              PID:232

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Initial Access

            Execution

            Persistence

            Privilege Escalation

            Defense Evasion

            Credential Access

            Discovery

            Query Registry

            1
            T1012

            Peripheral Device Discovery

            1
            T1120

            System Information Discovery

            1
            T1082

            Remote System Discovery

            1
            T1018

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Resource Development

            Reconnaissance

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\INF\netrasa.PNF
              Filesize

              22KB

              MD5

              80648b43d233468718d717d10187b68d

              SHA1

              a1736e8f0e408ce705722ce097d1adb24ebffc45

              SHA256

              8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

              SHA512

              eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

              Download Submit
            • C:\Windows\INF\netsstpa.PNF
              Filesize

              6KB

              MD5

              01e21456e8000bab92907eec3b3aeea9

              SHA1

              39b34fe438352f7b095e24c89968fca48b8ce11c

              SHA256

              35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

              SHA512

              9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

              Download Submit
            • memory/3080-19-0x00007FF6C79F0000-0x00007FF6C7AE8000-memory.dmp
              Filesize

              992KB

              Download
            • memory/3080-20-0x00007FFAC4780000-0x00007FFAC47B4000-memory.dmp
              Filesize

              208KB

              Download
            • memory/3080-21-0x00007FFAC44C0000-0x00007FFAC4774000-memory.dmp
              Filesize

              2.7MB

              Download
            • memory/3080-22-0x00007FFAB1700000-0x00007FFAB27AB000-memory.dmp
              Filesize

              16.7MB

              Download
            • memory/3080-23-0x00007FFAC01F0000-0x00007FFAC0302000-memory.dmp
              Filesize

              1.1MB

              Download
            • memory/4728-0-0x000001E97E190000-0x000001E97E193000-memory.dmp
              Filesize

              12KB

              Download
            • memory/4728-1-0x000001E97E1D0000-0x000001E97E1D2000-memory.dmp
              Filesize

              8KB

              Download
            • memory/4728-2-0x0000000180000000-0x0000000180032000-memory.dmp
              Filesize

              200KB

              Download