Resubmissions
01-11-2024 12:33
241101-pradyaypdv 1027-10-2024 23:08
241027-24hmasskhj 1020-10-2024 16:28
241020-tyzdvsxgqb 320-10-2024 16:26
241020-tx2gtszekk 302-10-2024 11:53
241002-n2j6fsycqb 313-09-2024 04:59
240913-fmwxpswcpb 311-09-2024 15:54
240911-tcmg6sygmm 311-09-2024 15:53
240911-tbsmsszbnh 1025-08-2024 22:53
240825-2t6als1gll 10Analysis
-
max time kernel
1800s -
max time network
1799s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
03-08-2024 12:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
230823-139hyshd3w_pw_infected.zip
Resource
win7-20240704-en
windows7-x64
0 signatures
1800 seconds
Behavioral task
behavioral2
Sample
230823-139hyshd3w_pw_infected.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral3
Sample
dl2.exe
Resource
win7-20240729-en
windows7-x64
4 signatures
1800 seconds
Behavioral task
behavioral4
Sample
dl2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
1800 seconds
General
-
Target
dl2.exe
-
Size
849KB
-
MD5
c2055b7fbaa041d9f68b9d5df9b45edd
-
SHA1
e4bd443bd4ce9029290dcd4bb47cb1a01f3b1b06
-
SHA256
342f04c4720590c40d24078d46d9b19d8175565f0af460598171d58f5ffc48f3
-
SHA512
18905b75938b8af9468b1aa3ffbae796a139c2762e623aa6ffb9ec2b293dd04aa1f90d1ed5a7dbda7853795a3688e368121a134c7f63e527a8e5e7679301a1dc
-
SSDEEP
12288:A3RY3yNqMRTF4q2rxHn2ot/81xpNQyjUXlmoe7ufjHAtjXD7r2:A3RY3R24q+xn/8Xp2yOl5fzQ/2
Score
10/10
Malware Config
Signatures
-
BazarBackdoor 64 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
flow ioc 44 zirabuo.bazar 45 zirabuo.bazar 95 zirabuo.bazar 98 zirabuo.bazar 89 zirabuo.bazar 107 zirabuo.bazar 106 zirabuo.bazar 65 zirabuo.bazar 80 zirabuo.bazar 94 zirabuo.bazar 105 zirabuo.bazar 81 zirabuo.bazar 50 zirabuo.bazar 56 zirabuo.bazar 68 zirabuo.bazar 71 zirabuo.bazar 55 zirabuo.bazar 74 zirabuo.bazar 79 zirabuo.bazar 101 zirabuo.bazar 72 zirabuo.bazar 73 zirabuo.bazar 75 zirabuo.bazar 76 zirabuo.bazar 46 zirabuo.bazar 52 zirabuo.bazar 63 zirabuo.bazar 66 zirabuo.bazar 78 zirabuo.bazar 86 zirabuo.bazar 88 zirabuo.bazar 91 zirabuo.bazar 87 zirabuo.bazar 97 zirabuo.bazar 108 zirabuo.bazar 113 zirabuo.bazar 48 zirabuo.bazar 53 zirabuo.bazar 67 zirabuo.bazar 82 zirabuo.bazar 57 zirabuo.bazar 77 zirabuo.bazar 110 zirabuo.bazar 69 zirabuo.bazar 90 zirabuo.bazar 93 zirabuo.bazar 109 zirabuo.bazar 99 zirabuo.bazar 102 zirabuo.bazar 112 zirabuo.bazar 47 zirabuo.bazar 59 zirabuo.bazar 60 zirabuo.bazar 84 zirabuo.bazar 61 zirabuo.bazar 111 zirabuo.bazar 100 zirabuo.bazar 54 zirabuo.bazar 62 zirabuo.bazar 64 zirabuo.bazar 83 zirabuo.bazar 85 zirabuo.bazar 92 zirabuo.bazar 96 zirabuo.bazar -
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
flow ioc 76 zirabuo.bazar 100 zirabuo.bazar 47 zirabuo.bazar 70 zirabuo.bazar 81 zirabuo.bazar 110 zirabuo.bazar 112 zirabuo.bazar 113 zirabuo.bazar 48 zirabuo.bazar 59 zirabuo.bazar 88 zirabuo.bazar 44 zirabuo.bazar 74 zirabuo.bazar 85 zirabuo.bazar 108 zirabuo.bazar 45 zirabuo.bazar 50 zirabuo.bazar 64 zirabuo.bazar 78 zirabuo.bazar 83 zirabuo.bazar 107 zirabuo.bazar 54 zirabuo.bazar 82 zirabuo.bazar 87 zirabuo.bazar 57 zirabuo.bazar 73 zirabuo.bazar 94 zirabuo.bazar 98 zirabuo.bazar 106 zirabuo.bazar 111 zirabuo.bazar 52 zirabuo.bazar 55 zirabuo.bazar 68 zirabuo.bazar 90 zirabuo.bazar 101 zirabuo.bazar 103 zirabuo.bazar 51 zirabuo.bazar 65 zirabuo.bazar 93 zirabuo.bazar 104 zirabuo.bazar 46 zirabuo.bazar 49 zirabuo.bazar 71 zirabuo.bazar 77 zirabuo.bazar 95 zirabuo.bazar 99 zirabuo.bazar 53 zirabuo.bazar 63 zirabuo.bazar 56 zirabuo.bazar 58 zirabuo.bazar 69 zirabuo.bazar 67 zirabuo.bazar 80 zirabuo.bazar 86 zirabuo.bazar 96 zirabuo.bazar 97 zirabuo.bazar 105 zirabuo.bazar 60 zirabuo.bazar 61 zirabuo.bazar 62 zirabuo.bazar 66 zirabuo.bazar 79 zirabuo.bazar 92 zirabuo.bazar 72 zirabuo.bazar -
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 185.117.154.144 Destination IP 5.132.191.104 Destination IP 81.2.241.148 Destination IP 87.98.175.85 Destination IP 46.101.70.183 Destination IP 45.32.160.206 Destination IP 89.35.39.64 Destination IP 82.196.9.45 Destination IP 142.4.205.47 Destination IP 89.35.39.64 Destination IP 51.255.48.78 Destination IP 46.101.70.183 Destination IP 193.183.98.66 Destination IP 45.63.124.65 Destination IP 163.53.248.170 Destination IP 91.217.137.37 Destination IP 5.135.183.146 Destination IP 31.171.251.118 Destination IP 198.251.90.143 Destination IP 167.99.153.82 Destination IP 147.135.185.78 Destination IP 144.76.133.38 Destination IP 51.254.25.115 Destination IP 172.104.136.243 Destination IP 82.141.39.32 Destination IP 128.52.130.209 Destination IP 147.135.185.78 Destination IP 51.254.25.115 Destination IP 69.164.196.21 Destination IP 139.99.96.146 Destination IP 185.121.177.177 Destination IP 193.183.98.66 Destination IP 92.222.97.145 Destination IP 51.254.25.115 Destination IP 96.47.228.108 Destination IP 89.35.39.64 Destination IP 142.4.204.111 Destination IP 5.45.97.127 Destination IP 142.4.205.47 Destination IP 176.126.70.119 Destination IP 51.254.25.115 Destination IP 192.99.85.244 Destination IP 185.121.177.177 Destination IP 139.99.96.146 Destination IP 82.196.9.45 Destination IP 185.164.136.225 Destination IP 162.248.241.94 Destination IP 144.76.133.38 Destination IP 5.132.191.104 Destination IP 147.135.185.78 Destination IP 130.255.78.223 Destination IP 138.197.25.214 Destination IP 104.37.195.178 Destination IP 158.69.239.167 Destination IP 89.18.27.167 Destination IP 142.4.205.47 Destination IP 158.69.160.164 Destination IP 147.135.185.78 Destination IP 139.99.96.146 Destination IP 142.4.204.111 Destination IP 104.37.195.178 Destination IP 192.52.166.110 Destination IP 51.255.211.146 Destination IP 35.196.105.24 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2532 dl2.exe 2732 dl2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dl2.exe"C:\Users\Admin\AppData\Local\Temp\dl2.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:2532
-
C:\Users\Admin\AppData\Local\Temp\dl2.exeC:\Users\Admin\AppData\Local\Temp\dl2.exe {75C28CED-24E5-463D-B519-AD70CEDB9284}1⤵
- Suspicious use of SetWindowsHookEx
PID:2732