bazaloader | 5718b9d98c2b5f09acf7c2d46f24f0da693fff624908199d999b778983c8ee6c

General

Target

7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe
Size

5.2MB
MD5

2e025daacfe1def8ac1fa48820d2c8ce
SHA1

86da098c8b04844ca54c35429d77cdd3273754e3
SHA256

7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8
SHA512

43c42d5817c59478890b6ab6520bb179960010434b3d114976528f475c331f1e6f69d93e7d7639da75c0ac00b5462825e4e53a830278e58f72cb2b7138454e9d
SSDEEP

98304:2/q+71dO2ooGsM8ZHUTFhqB4smvdzeQbDKRRemADhDGDj0DTHUL+:2/qEamGUZ0TFnvdiQbDaf0DDUL

Score

10^/10

bazaloader evasion execution persistence privilege_escalation trojan

Malware Config

Signatures

Bazaloader family
bazaloader

Detects BazaLoader malware 4 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests - JaffaCakes118.

trojan

resource	yara_rule
behavioral2/memory/3060-2-0x0000000140000000-0x0000000140632400-memory.dmp	BazaLoader
behavioral2/memory/3060-28-0x0000000140000000-0x0000000140632400-memory.dmp	BazaLoader
behavioral2/memory/780-31-0x0000000140000000-0x0000000140632400-memory.dmp	BazaLoader
behavioral2/memory/780-57-0x0000000140000000-0x0000000140632400-memory.dmp	BazaLoader

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4164	powershell.exe
2948	powershell.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2320	netsh.exe
2356	netsh.exe
2160	netsh.exe
2120	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
780	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe
File created	C:\Windows\System\svchost.exe	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe
File opened for modification	C:\Windows\System\svchost.exe	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4164	powershell.exe
4164	powershell.exe
3060	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe
3060	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe
2948	powershell.exe
2948	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 4164	3060	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe	96
PID 3060 wrote to memory of 4164	3060	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe	96
PID 3060 wrote to memory of 2120	3060	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe	98
PID 3060 wrote to memory of 2120	3060	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe	98
PID 3060 wrote to memory of 2320	3060	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe	100
PID 3060 wrote to memory of 2320	3060	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe	100
PID 3060 wrote to memory of 3360	3060	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe	102
PID 3060 wrote to memory of 3360	3060	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe	102
PID 3060 wrote to memory of 780	3060	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe	104
PID 3060 wrote to memory of 780	3060	7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe	104
PID 780 wrote to memory of 2948	780	svchost.exe	110
PID 780 wrote to memory of 2948	780	svchost.exe	110
PID 780 wrote to memory of 2356	780	svchost.exe	112
PID 780 wrote to memory of 2356	780	svchost.exe	112
PID 780 wrote to memory of 2160	780	svchost.exe	114
PID 780 wrote to memory of 2160	780	svchost.exe	114

C:\Users\Admin\AppData\Local\Temp\7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe
"C:\Users\Admin\AppData\Local\Temp\7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2120
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2320
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3360
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2356
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cuzfpmgs.1c4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp

Filesize
2.8MB

MD5
a713248bfd1f5b37244accbdceafddbf

SHA1
cd80ea6f50c92c381e5adcc4872d88abbfa57221

SHA256
1b4df362df8b1be3445d6818b91fb119a8a2e2a742837f4743d47bfae0336a8a

SHA512
cf649112f1b85e3bb7644542e2c6e9b0da732b3cf2ac1ab0b57a99fa552f21880f2e4a06a9a9c0ca7344fa78397b518de7bb2dc1c7eff0d011985a0ad74c4bc7

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
15.9MB

MD5
3c7388733c21e5daa64f22b089b72326

SHA1
2ff378c8a79aa1ff36e2069e6727c3952bd03763

SHA256
2ac858f45bcda5547744f9f646db9333788743f4949fe7cdb0c6cda1a9c31f00

SHA512
6351b80b3ea13566a5874792b0d2530752545b91f31091405b55d9021591096737bbbb7c219361e49b9749d4e9ac69e35423a702d3184df8a8f2df13667af9f6

Download Submit
C:\Windows\System\svchost.exe

Filesize
5.2MB

MD5
2e025daacfe1def8ac1fa48820d2c8ce

SHA1
86da098c8b04844ca54c35429d77cdd3273754e3

SHA256
7fba11e6cf45e2b1f27fa0011e65c00c71c227d151eb4ed7975e50320f9e26c8

SHA512
43c42d5817c59478890b6ab6520bb179960010434b3d114976528f475c331f1e6f69d93e7d7639da75c0ac00b5462825e4e53a830278e58f72cb2b7138454e9d

Download Submit
memory/780-57-0x0000000140000000-0x0000000140632400-memory.dmp

Filesize
6.2MB

Download
memory/780-45-0x0000000010000000-0x00000000104FC000-memory.dmp

Filesize
5.0MB

Download
memory/780-30-0x0000000140000000-0x0000000140632400-memory.dmp

Filesize
6.2MB

Download
memory/780-31-0x0000000140000000-0x0000000140632400-memory.dmp

Filesize
6.2MB

Download
memory/3060-1-0x0000000140000000-0x0000000140632400-memory.dmp

Filesize
6.2MB

Download
memory/3060-28-0x0000000140000000-0x0000000140632400-memory.dmp

Filesize
6.2MB

Download
memory/3060-2-0x0000000140000000-0x0000000140632400-memory.dmp

Filesize
6.2MB

Download
memory/3060-3-0x0000000140001000-0x000000014001C000-memory.dmp

Filesize
108KB

Download
memory/3060-0-0x0000000140000000-0x0000000140632400-memory.dmp

Filesize
6.2MB

Download
memory/4164-19-0x00007FFE6CC20000-0x00007FFE6D6E1000-memory.dmp

Filesize
10.8MB

Download
memory/4164-16-0x00007FFE6CC20000-0x00007FFE6D6E1000-memory.dmp

Filesize
10.8MB

Download
memory/4164-15-0x00007FFE6CC20000-0x00007FFE6D6E1000-memory.dmp

Filesize
10.8MB

Download
memory/4164-14-0x000002137A980000-0x000002137A9A2000-memory.dmp

Filesize
136KB

Download
memory/4164-4-0x00007FFE6CC23000-0x00007FFE6CC25000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads