Managed XDR

home-cde-work-sample-g...613acf1873f198a4abad83 (Bazar Loader) — отчёт о динамическом анализе вредоносного файла

Информация о файле

Имя файла
home-cde-work-sample-gray-cde_pe_samples-sample_decompress-20210122-2021_1_22_4_48_52_436528_7f4827cde6488422d0f6093d09821105-hit-a449dd60d5613acf1873f198a4abad83
Тип файла
PE32+ executable (GUI) x86-64, for MS Windows
Размер файла
540.7 KB
Первое обнаружение
Последнее обнаружение

Окружение

w10/x64 en

Хеши

SHA1
5e97b0e9e45b8ea671ebb874e621979cfdb84f4e
SHA256
0bfb64dff37dd50449af75ec204f0b4981ac3b16790458f6a492c7b27905a9a7
MD5
a449dd60d5613acf1873f198a4abad83

Вредоносное ПО

  • Bazar Loader

Сигнатуры

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1055 injection_failed: The attempt to inject into a process has failed

Defense Evasion

T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1036.001 invalid_authenticode: Digital signature of the executable file has failed the verification
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1055 injection_failed: The attempt to inject into a process has failed

Credential Access

T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Discovery

T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization

Command and Control

T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Other

suricata_alert: Malicious traffic detected
network_dns_blockchain: DNS query to Blockchain domain or TLD discovered
network_bind: Starts servers listening at None
dns_without_resolve: DNS query without a response
no_graphical_activity: No graphic activity
create_rpc_bindings: Creates RPC connection
has_pdb: This executable file has a PDB path
suspicious_network_port: Performs TCP or UDP request to non-standard port
test_check_service: Starts services
pe_overlay: PE file contains overlay
yara_rules: Static rules

Похожие отчёты

Managed XDR