Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-04-2024 10:45
General
-
Target
47bac27be954cf593ac731cd57fa98b565cf5036a6fbf35c508549f039eea8f3.exe
-
Size
460KB
-
MD5
513b43a30628978d52d18912b72dcdd0
-
SHA1
97368003849122e99dc7b0e25b4b37b2999053ee
-
SHA256
47bac27be954cf593ac731cd57fa98b565cf5036a6fbf35c508549f039eea8f3
-
SHA512
a8e846109b644df3e905e33ae2218b5f0c7f65efd2a202c2d2c38a89d2e979d4379862b545523b7338855f51f087ad4d7c41746197e9f233e938ed4bbfbb5c0c
-
SSDEEP
12288:pD9hZ/eUiiltydLC8U+qJACVTUsf7kppRw+:UL5C8JqJACVzkzW+
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 5 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\47bac27be954cf593ac731cd57fa98b565cf5036a6fbf35c508549f039eea8f3.exe"C:\Users\Admin\AppData\Local\Temp\47bac27be954cf593ac731cd57fa98b565cf5036a6fbf35c508549f039eea8f3.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\47bac27be954cf593ac731cd57fa98b565cf5036a6fbf35c508549f039eea8f3.exeC:\Users\Admin\AppData\Local\Temp\47bac27be954cf593ac731cd57fa98b565cf5036a6fbf35c508549f039eea8f3.exe {D8C414F3-ECC2-4147-8EA4-0AA98C11AE03}1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2136-0-0x0000000000340000-0x0000000000352000-memory.dmpFilesize
72KB
-
memory/2136-3-0x0000000000340000-0x0000000000352000-memory.dmpFilesize
72KB
-
memory/2136-2-0x00000000003E0000-0x00000000003F4000-memory.dmpFilesize
80KB
-
memory/2136-7-0x0000000000500000-0x0000000000516000-memory.dmpFilesize
88KB
-
memory/2704-18-0x0000000000300000-0x0000000000314000-memory.dmpFilesize
80KB
-
memory/2704-22-0x00000000003B0000-0x00000000003C6000-memory.dmpFilesize
88KB