Overview
overview
10Static
static
10bazaar.202...ge.exe
windows7-x64
1bazaar.202...ge.exe
windows10-2004-x64
1bazaar.202...te.exe
windows7-x64
10bazaar.202...te.exe
windows10-2004-x64
10bazaar.202...te.exe
windows7-x64
10bazaar.202...te.exe
windows10-2004-x64
10bazaar.202...te.exe
windows7-x64
10bazaar.202...te.exe
windows10-2004-x64
10bazaar.202...te.exe
windows7-x64
10bazaar.202...te.exe
windows10-2004-x64
10bazaar.202...te.exe
windows7-x64
10bazaar.202...te.exe
windows10-2004-x64
10bazaar.202...te.exe
windows7-x64
10bazaar.202...te.exe
windows10-2004-x64
10bazaar.202...te.exe
windows7-x64
6bazaar.202...te.exe
windows10-2004-x64
6bazaar.202...te.exe
windows7-x64
10bazaar.202...te.exe
windows10-2004-x64
10bazaar.202...te.exe
windows7-x64
10bazaar.202...te.exe
windows10-2004-x64
3bazaar.202...te.exe
windows7-x64
10bazaar.202...te.exe
windows10-2004-x64
10bazaar.202...32.exe
windows7-x64
7bazaar.202...32.exe
windows10-2004-x64
7bazaar.202...32.exe
windows7-x64
7bazaar.202...32.exe
windows10-2004-x64
7bazaar.202...RC.exe
windows7-x64
1bazaar.202...RC.exe
windows10-2004-x64
1bazaar.202...oad.js
windows7-x64
3bazaar.202...oad.js
windows10-2004-x64
3bazaar.202...nt.exe
windows7-x64
7bazaar.202...nt.exe
windows10-2004-x64
7Resubmissions
28-04-2024 18:31
240428-w6cwyaec5v 1021-04-2024 08:57
240421-kwwqhsfh8z 1021-04-2024 05:45
240421-gfvazacf82 1018-04-2024 19:05
240418-xry2ascb73 1018-04-2024 16:34
240418-t3alashf75 1004-03-2024 18:33
240304-w7b12ahg61 1002-03-2024 17:01
240302-vjn51sff57 1002-03-2024 10:05
240302-l4xhfscc7v 10Analysis
-
max time kernel
285s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 18:31
Static task
static1
Behavioral task
behavioral1
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.Revenge.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.Revenge.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral19
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral21
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral23
Sample
bazaar.2020.02/HEUR-Backdoor.Win32.exe
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
bazaar.2020.02/HEUR-Backdoor.Win32.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral25
Sample
bazaar.2020.02/HEUR-Backdoor.Win32.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
bazaar.2020.02/HEUR-Backdoor.Win32.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral27
Sample
bazaar.2020.02/HEUR-Backdoor.Win32.NetWiredRC.exe
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
bazaar.2020.02/HEUR-Backdoor.Win32.NetWiredRC.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
bazaar.2020.02/HEUR-Trojan-Downloader.Script.SLoad.js
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
bazaar.2020.02/HEUR-Trojan-Downloader.Script.SLoad.js
Resource
win10v2004-20240419-en
Behavioral task
behavioral31
Sample
bazaar.2020.02/HEUR-Trojan-PSW.MSIL.Agent.exe
Resource
win7-20240419-en
General
-
Target
bazaar.2020.02/HEUR-Backdoor.Win32.exe
-
Size
43KB
-
MD5
f3cbdffbf6bfc26fe09f95e88b188c09
-
SHA1
e8feb8d7baa1290f591693f068cd6941cb9c878c
-
SHA256
1c659cbf8f73b2dd0ed8238595c225dbc1e87d5ea538c24a5d52faf0f4a49e7d
-
SHA512
bac9cc4ebde8e1133d8a332c327dcc72ef83f3457b3048899be3550c7d1c03c8c59d0ab82304def44793ac9fc91a193a018e6fbb256681b5baad366df4e8b3b3
-
SSDEEP
768:VrgeWGJaj2b2/K6/1CSGIKPlavRzY0nEs3UgLM6KLi0z1xxFopI:ybs4K6dyNPIvRMEEgCnxipI
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Stpxrq.exeStpxrq.exepid Process 2604 Stpxrq.exe 2528 Stpxrq.exe -
Loads dropped DLL 1 IoCs
Processes:
Stpxrq.exepid Process 2604 Stpxrq.exe -
Creates a Windows Service
-
Drops file in System32 directory 5 IoCs
Processes:
Stpxrq.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CF14D1855652602540DFCFECD21854DB_71F4740D37287A91812B9479338ACF24 Stpxrq.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Stpxrq.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475 Stpxrq.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475 Stpxrq.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CF14D1855652602540DFCFECD21854DB_71F4740D37287A91812B9479338ACF24 Stpxrq.exe -
Drops file in Program Files directory 2 IoCs
Processes:
HEUR-Backdoor.Win32.exedescription ioc Process File created C:\Program Files (x86)\Microsoft Qizfbz\Stpxrq.exe HEUR-Backdoor.Win32.exe File opened for modification C:\Program Files (x86)\Microsoft Qizfbz\Stpxrq.exe HEUR-Backdoor.Win32.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
Stpxrq.exedescription ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C6FE3111-72D3-4E81-BC07-5764E5CEA9F9}\WpadDecisionReason = "1" Stpxrq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs Stpxrq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Stpxrq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-70-30-e2-59-87\WpadDecisionReason = "1" Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Stpxrq.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Stpxrq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C6FE3111-72D3-4E81-BC07-5764E5CEA9F9}\WpadDecision = "0" Stpxrq.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C6FE3111-72D3-4E81-BC07-5764E5CEA9F9}\WpadNetworkName = "Network 3" Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-70-30-e2-59-87 Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs Stpxrq.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Stpxrq.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0133000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Stpxrq.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-70-30-e2-59-87\WpadDecisionTime = 002433709a99da01 Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Stpxrq.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates Stpxrq.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs Stpxrq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs Stpxrq.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C6FE3111-72D3-4E81-BC07-5764E5CEA9F9} Stpxrq.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C6FE3111-72D3-4E81-BC07-5764E5CEA9F9}\WpadDecisionTime = 002433709a99da01 Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C6FE3111-72D3-4E81-BC07-5764E5CEA9F9}\06-70-30-e2-59-87 Stpxrq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-70-30-e2-59-87\WpadDecision = "0" Stpxrq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Stpxrq.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
HEUR-Backdoor.Win32.exepid Process 1936 HEUR-Backdoor.Win32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
HEUR-Backdoor.Win32.exedescription pid Process Token: SeDebugPrivilege 1936 HEUR-Backdoor.Win32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Stpxrq.exedescription pid Process procid_target PID 2604 wrote to memory of 2528 2604 Stpxrq.exe 29 PID 2604 wrote to memory of 2528 2604 Stpxrq.exe 29 PID 2604 wrote to memory of 2528 2604 Stpxrq.exe 29 PID 2604 wrote to memory of 2528 2604 Stpxrq.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.Win32.exe"C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.Win32.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
C:\Program Files (x86)\Microsoft Qizfbz\Stpxrq.exe"C:\Program Files (x86)\Microsoft Qizfbz\Stpxrq.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files (x86)\Microsoft Qizfbz\Stpxrq.exe"C:\Program Files (x86)\Microsoft Qizfbz\Stpxrq.exe" Win72⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2528
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5f3cbdffbf6bfc26fe09f95e88b188c09
SHA1e8feb8d7baa1290f591693f068cd6941cb9c878c
SHA2561c659cbf8f73b2dd0ed8238595c225dbc1e87d5ea538c24a5d52faf0f4a49e7d
SHA512bac9cc4ebde8e1133d8a332c327dcc72ef83f3457b3048899be3550c7d1c03c8c59d0ab82304def44793ac9fc91a193a018e6fbb256681b5baad366df4e8b3b3