Resubmissions

28-04-2024 18:31

240428-w6cwyaec5v 10

21-04-2024 08:57

240421-kwwqhsfh8z 10

21-04-2024 05:45

240421-gfvazacf82 10

18-04-2024 19:05

240418-xry2ascb73 10

18-04-2024 16:34

240418-t3alashf75 10

04-03-2024 18:33

240304-w7b12ahg61 10

02-03-2024 17:01

240302-vjn51sff57 10

02-03-2024 10:05

240302-l4xhfscc7v 10

Analysis

  • max time kernel
    285s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 18:31

General

  • Target

    bazaar.2020.02/HEUR-Backdoor.Win32.exe

  • Size

    43KB

  • MD5

    f3cbdffbf6bfc26fe09f95e88b188c09

  • SHA1

    e8feb8d7baa1290f591693f068cd6941cb9c878c

  • SHA256

    1c659cbf8f73b2dd0ed8238595c225dbc1e87d5ea538c24a5d52faf0f4a49e7d

  • SHA512

    bac9cc4ebde8e1133d8a332c327dcc72ef83f3457b3048899be3550c7d1c03c8c59d0ab82304def44793ac9fc91a193a018e6fbb256681b5baad366df4e8b3b3

  • SSDEEP

    768:VrgeWGJaj2b2/K6/1CSGIKPlavRzY0nEs3UgLM6KLi0z1xxFopI:ybs4K6dyNPIvRMEEgCnxipI

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Creates a Windows Service
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.Win32.exe
    "C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.Win32.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    PID:1936
  • C:\Program Files (x86)\Microsoft Qizfbz\Stpxrq.exe
    "C:\Program Files (x86)\Microsoft Qizfbz\Stpxrq.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Program Files (x86)\Microsoft Qizfbz\Stpxrq.exe
      "C:\Program Files (x86)\Microsoft Qizfbz\Stpxrq.exe" Win7
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft Qizfbz\Stpxrq.exe

    Filesize

    43KB

    MD5

    f3cbdffbf6bfc26fe09f95e88b188c09

    SHA1

    e8feb8d7baa1290f591693f068cd6941cb9c878c

    SHA256

    1c659cbf8f73b2dd0ed8238595c225dbc1e87d5ea538c24a5d52faf0f4a49e7d

    SHA512

    bac9cc4ebde8e1133d8a332c327dcc72ef83f3457b3048899be3550c7d1c03c8c59d0ab82304def44793ac9fc91a193a018e6fbb256681b5baad366df4e8b3b3

  • memory/1936-3-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB