Overview
overview
10Static
static
10b2bd3de3e5...bb.exe
windows10-2004-x64
10cd9ccf8681...f7.exe
windows10-2004-x64
10cobaltstri...de.exe
windows10-2004-x64
10default.exe
windows10-2004-x64
10ec4f09f82d...d3.exe
windows10-2004-x64
10emotet_exe...04.exe
windows10-2004-x64
10emotet_exe...23.exe
windows10-2004-x64
10eupdate.exe
windows10-2004-x64
7f4f47c67be...3f.exe
windows10-2004-x64
10fb5d110ced...9c.exe
windows10-2004-x64
6fee15285c3...35.exe
windows10-2004-x64
10file(1).exe
windows10-2004-x64
1file.exe
windows10-2004-x64
7gjMEi6eG.exe
windows10-2004-x64
10good.exe
windows10-2004-x64
10hyundai st...1).exe
windows10-2004-x64
10hyundai st...10.exe
windows10-2004-x64
10infected d...er.exe
windows10-2004-x64
10inps_979.xls
windows10-2004-x64
1june9.dll
windows10-2004-x64
10mouse_2.exe
windows10-2004-x64
10oof.exe
windows10-2004-x64
10openme.exe
windows10-2004-x64
10ou55sg33s_1.exe
windows10-2004-x64
10senate.dll
windows10-2004-x64
10starticon3.exe
windows10-2004-x64
10update.exe
windows10-2004-x64
10vir1.xlsx
windows10-2004-x64
1wwf[1].exe
windows10-2004-x64
10xNet.dll
windows10-2004-x64
1전산 및...��.exe
windows10-2004-x64
10전산 및...�1.exe
windows10-2004-x64
10Resubmissions
15/04/2025, 17:34
250415-v5ylksypw9 1015/04/2025, 06:16
250415-g1p7ras1dw 1014/04/2025, 08:06
250414-jzpwpstxhx 1014/04/2025, 07:59
250414-jvg1assky4 1014/04/2025, 07:22
250414-h7g1dss1h1 1014/04/2025, 07:16
250414-h3xv2s1nv6 1011/04/2025, 21:39
250411-1h113szzaz 1001/04/2025, 21:24
250401-z8184awycs 10Analysis
-
max time kernel
129s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
14/04/2025, 08:06
Static task
static1
Behavioral task
behavioral1
Sample
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
cd9ccf8681ed1a5380f8a27cd6dc927ab719b04baa6c6583a0c793a6dc00d5f7.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
cobaltstrike_shellcode.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
default.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
emotet_exe_e1_ef536781ae8be4b67a7fb8aa562d84994ad250d97d5606115b6f4e6e2992363f_2020-11-17__174504.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
emotet_exe_e3_93074e9fbde60e4182f5d763bac7762f2d4e2fcf9baf457b6f12e7696b3562c1_2020-11-17__182823.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
eupdate.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d35.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
file(1).exe
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
file.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
gjMEi6eG.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
good.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
hyundai steel-pipe- job 8010(1).exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
hyundai steel-pipe- job 8010.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
infected dot net installer.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
inps_979.xls
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
june9.dll
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
mouse_2.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
oof.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
openme.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
ou55sg33s_1.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
senate.dll
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
starticon3.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
update.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
vir1.xlsx
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
wwf[1].exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
xNet.dll
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
General
-
Target
f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
-
Size
332KB
-
MD5
1e0ff1a8078820c5c10652e406d51bef
-
SHA1
e191fdbe58b527301eb4bd244a2258ba1cad0182
-
SHA256
f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f
-
SHA512
eb1a011724b988362aa52bdcb69d2886b736dbbe72fe9e53fa3530eeec6bb4089519896a88af48df8e99c7010930fb84cd33599e57f8477e8748cf5259e428a0
-
SSDEEP
6144:R+xWEy53Bhj8sW4y9wTeT10hFPascnojIXTvUv7ohqfp2:RSw53Bhj8sW4ya6T6hFPasco4cv7o7
Malware Config
Signatures
-
BazarBackdoor 64 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
description flow ioc Process 104 younika-hayde.bazar Process not Found 98 younika-hayde.bazar Process not Found 115 younika-hayde.bazar Process not Found 119 younika-hayde.bazar Process not Found 79 younika-hayde.bazar Process not Found 109 younika-hayde.bazar Process not Found Key created \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\Root f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe 51 younika-hayde.bazar Process not Found 80 younika-hayde.bazar Process not Found 92 younika-hayde.bazar Process not Found 110 younika-hayde.bazar Process not Found 114 younika-hayde.bazar Process not Found 87 younika-hayde.bazar Process not Found 102 younika-hayde.bazar Process not Found 108 younika-hayde.bazar Process not Found 112 younika-hayde.bazar Process not Found 52 younika-hayde.bazar Process not Found 59 younika-hayde.bazar Process not Found 64 younika-hayde.bazar Process not Found 69 younika-hayde.bazar Process not Found 71 younika-hayde.bazar Process not Found 70 younika-hayde.bazar Process not Found 74 younika-hayde.bazar Process not Found 82 younika-hayde.bazar Process not Found 85 younika-hayde.bazar Process not Found 90 younika-hayde.bazar Process not Found 121 younika-hayde.bazar Process not Found 123 younika-hayde.bazar Process not Found 68 younika-hayde.bazar Process not Found 84 younika-hayde.bazar Process not Found 117 younika-hayde.bazar Process not Found 86 younika-hayde.bazar Process not Found 106 younika-hayde.bazar Process not Found 81 younika-hayde.bazar Process not Found 60 younika-hayde.bazar Process not Found 76 younika-hayde.bazar Process not Found 89 younika-hayde.bazar Process not Found 118 younika-hayde.bazar Process not Found 122 younika-hayde.bazar Process not Found 124 younika-hayde.bazar Process not Found 75 younika-hayde.bazar Process not Found 78 younika-hayde.bazar Process not Found 83 younika-hayde.bazar Process not Found 111 younika-hayde.bazar Process not Found 113 younika-hayde.bazar Process not Found 67 younika-hayde.bazar Process not Found 61 younika-hayde.bazar Process not Found 77 younika-hayde.bazar Process not Found 97 younika-hayde.bazar Process not Found 100 younika-hayde.bazar Process not Found 101 younika-hayde.bazar Process not Found 105 younika-hayde.bazar Process not Found 120 younika-hayde.bazar Process not Found 57 younika-hayde.bazar Process not Found 73 younika-hayde.bazar Process not Found 107 younika-hayde.bazar Process not Found 116 younika-hayde.bazar Process not Found 66 younika-hayde.bazar Process not Found 103 younika-hayde.bazar Process not Found 56 younika-hayde.bazar Process not Found 63 younika-hayde.bazar Process not Found 72 younika-hayde.bazar Process not Found 93 younika-hayde.bazar Process not Found 99 younika-hayde.bazar Process not Found -
Bazarbackdoor family
-
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
flow ioc 75 younika-hayde.bazar 93 younika-hayde.bazar 114 younika-hayde.bazar 123 younika-hayde.bazar 52 younika-hayde.bazar 73 younika-hayde.bazar 85 younika-hayde.bazar 87 younika-hayde.bazar 91 younika-hayde.bazar 100 younika-hayde.bazar 111 younika-hayde.bazar 69 younika-hayde.bazar 108 younika-hayde.bazar 71 younika-hayde.bazar 104 younika-hayde.bazar 110 younika-hayde.bazar 60 younika-hayde.bazar 80 younika-hayde.bazar 94 younika-hayde.bazar 95 younika-hayde.bazar 117 younika-hayde.bazar 122 younika-hayde.bazar 51 younika-hayde.bazar 62 younika-hayde.bazar 64 younika-hayde.bazar 83 younika-hayde.bazar 109 younika-hayde.bazar 120 younika-hayde.bazar 113 younika-hayde.bazar 116 younika-hayde.bazar 56 younika-hayde.bazar 67 younika-hayde.bazar 72 younika-hayde.bazar 98 younika-hayde.bazar 57 younika-hayde.bazar 74 younika-hayde.bazar 99 younika-hayde.bazar 103 younika-hayde.bazar 115 younika-hayde.bazar 119 younika-hayde.bazar 89 younika-hayde.bazar 101 younika-hayde.bazar 63 younika-hayde.bazar 65 younika-hayde.bazar 66 younika-hayde.bazar 79 younika-hayde.bazar 81 younika-hayde.bazar 102 younika-hayde.bazar 106 younika-hayde.bazar 121 younika-hayde.bazar 96 younika-hayde.bazar 107 younika-hayde.bazar 105 younika-hayde.bazar 59 younika-hayde.bazar 61 younika-hayde.bazar 84 younika-hayde.bazar 92 younika-hayde.bazar 70 younika-hayde.bazar 76 younika-hayde.bazar 90 younika-hayde.bazar 112 younika-hayde.bazar 124 younika-hayde.bazar 77 younika-hayde.bazar 82 younika-hayde.bazar -
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 51 51.254.25.115 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 59 185.121.177.177 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 65 142.4.204.111 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 76 50.3.82.215 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 93 104.238.186.189 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 111 185.164.136.225 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 123 138.197.25.214 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 57 87.98.175.85 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 62 5.132.191.104 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 63 111.67.20.8 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 103 89.35.39.64 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 116 45.32.160.206 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 107 185.117.154.144 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 70 158.69.160.164 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 73 81.2.241.148 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 77 46.101.70.183 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 84 163.172.185.51 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 86 5.135.183.146 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 113 63.231.92.27 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 115 96.47.228.108 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 66 142.4.205.47 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 81 139.59.208.246 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 91 51.255.211.146 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 120 162.248.241.94 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 121 107.172.42.186 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 68 104.37.195.178 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 71 46.28.207.199 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 83 45.71.112.70 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 87 51.255.48.78 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 56 91.217.137.37 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 82 172.104.136.243 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 97 45.63.124.65 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 102 146.185.176.36 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 60 169.239.202.202 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 72 31.171.251.118 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 96 94.177.171.127 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 85 87.98.175.85 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 112 192.52.166.110 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 75 82.141.39.32 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 122 167.99.153.82 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 89 147.135.185.78 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 101 82.196.9.45 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 109 139.99.96.146 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 52 193.183.98.66 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 61 198.251.90.143 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 74 51.254.25.115 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 104 89.18.27.167 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 124 69.164.196.21 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 64 163.53.248.170 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 90 92.222.97.145 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 100 185.208.208.141 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 105 77.73.68.161 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 108 176.126.70.119 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 78 5.45.97.127 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 95 193.183.98.66 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 99 178.17.170.179 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 106 91.217.137.37 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 69 192.99.85.244 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 80 144.76.133.38 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 92 159.89.249.249 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 98 212.24.98.54 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 117 128.52.130.209 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 94 139.59.23.241 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe Destination IP 110 217.12.210.54 3064 f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
description flow ioc HTTP URL 50 https://api.opennicproject.org/geoip/