Overview

overview

10

Static

static

3

3c7dc6cd19...18.exe

windows7-x64

10

3c7dc6cd19...18.exe

windows10-2004-x64

10

Resubmissions

27-10-2024 20:10

241027-yxvfqssfjl 10

27-10-2024 20:09

241027-yw56vasern 10

12-10-2024 23:03

241012-21re2awemd 10

Analysis

  • max time kernel
    1356s
  • max time network
    1150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-10-2024 20:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118.exe

  • Size

    178KB

  • MD5

    3c7dc6cd19e758840ed1aa76c8571f67

  • SHA1

    5f7b02bd8c8854adfb132817f0edae1771bcdb72

  • SHA256

    1d005321c8b45f25e1d012496e4fea43544c6f02af84d28c2c348fd04724d45c

  • SHA512

    ee9cf414295a9dbed765a290d6b6dd061e695149670c5809619ef4d3b38f7a1fb7a7e1273d1f3613db322d68e40d7770825eb70890c878b850c5f42477d9b15b

  • SSDEEP

    3072:vNcsPrIDUfRgcnOzJn/hJYxqWlDDgbOsSrIf4+udEB:+Y1IJZGzlDtrIcdg

Score
10/10
bazarbackdoorbackdoordiscovery

Malware Config

Signatures

  • BazarBackdoor 64 IoCs

    Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.

    backdoorbazarbackdoor
  • Bazarbackdoor family
    bazarbackdoor
  • Contacts a large (5008) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Tries to connect to .bazar domain 64 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118.exe"
    1⤵
      PID:4056
    • C:\Users\Admin\AppData\Local\Temp\3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\3c7dc6cd19e758840ed1aa76c8571f67_JaffaCakes118.exe {0BBECA61-8C01-4F4B-95BC-2F9EE9AA7CA2}
      1⤵
        PID:3052

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads