BazarBackdoor

It also included coders developing malware crypters, front- and back-end environments, TrickBot web-injects and various other modules.

Conti’s backbone was the development team, with subdivisions responsible for building malware, testing its functionality, and recruiting and onboarding new employees.

Initially appearing around April of 2020, the malware was spread in email campaigns utilizing infrastructure previously used to distribute Trickbot.

Shathak stores malicious documents in password-protected archive files and attaches the archive files to phishing emails.

The social engineering attacks that were used to spread the backdoor leverage topics such as customer complaints, Covid-19-themed payroll reports, and employee termination lists for the emails they send out. The messages have links to Google Docs files.

This =WmiC| command is a DDE function that causes Microsoft Excel, if given permission, to launch WMIC.exe and execute the provided PowerShell command to input data into the open workbook.

This sets a scheduled task that launches the loader every time the user logs into Windows, which makes way for new versions of the backdoor to be downloaded and injected into svchost.exe.

In this particular case, the DDE will use WMIC to create a new PowerShell process that opens a remote URL containing another PowerShell command that is then executed.

The shortcut file has to be run by the victim to begin the chain of infection.

Microsoft Excel supports a feature called Dynamic Data Exchange (DDE), which can be used to execute commands whose output is inputted into the open spreadsheet, including CSV files. Unfortunately, threat actors can also abuse this feature to execute commands that download and install malware on unsuspecting victims.

This sets a scheduled task that launches the loader every time the user logs into Windows, which makes way for new versions of the backdoor to be downloaded and injected into svchost.exe.

When we mount the malicious ISO file, we see that a drive is mounted on the system that contains a shortcut file named “Attachments.lnk” and a hidden file named “documents.log” .

This sets a scheduled task that launches the loader every time the user logs into Windows, which makes way for new versions of the backdoor to be downloaded and injected into svchost.exe.

The payload will then be injected filelessly into C:\Windows\system32\svchost.exe through process hollowing and process doppelgänging techniques.

The payload will then be injected filelessly into C:\Windows\system32\svchost.exe through process hollowing and process doppelgänging techniques.

When we mount the malicious ISO file, we see that a drive is mounted on the system that contains a shortcut file named “Attachments.lnk” and a hidden file named “documents.log” .

One of those methods is string obfuscation, where the malware uses encoded stack strings to hide them from static analysis.

At this point, we can safely guess that sub_1800045D6 is an API resolving function, and the parameter it takes is the hash of the API’s name.

Clicking on the link downloads an executable that masquerades through icons and names associated with the mentioned file types. For instance, the supposed customer complaint document will be downloaded as Preview.PDF.exe, which uses the PDF icon. Since the file extension is hidden by default, the file will convincingly appear as a PDF file.

The payload will then be injected filelessly into C:\Windows\system32\svchost.exe through process hollowing and process doppelgänging techniques.

The payload will then be injected filelessly into C:\Windows\system32\svchost.exe through process hollowing and process doppelgänging techniques.

a typical encoded string is pushed on the stack and decoded dynamically using some multiplication, subtraction, and modulus operations.

The macro drops a Microsoft Hypertext Markup Language (HTML) Applications (HTA) file on the file system and then executes the file using the mshta.exe Windows utility.

downloads a file and writes it to disk as a .jpg file and registers it as a service using regsrv32.exe.

C:\Windows\System32\rundll32.exe documents.log,vspa

Then, it just executes qmemcpy to copy the data in the second variable to the returned virtual base address. This tells us two things. First, our guess that the v19 variable will contain the address to executable code is correct. Second, we know that the executable code is shellcode since the data is mapped and executed directly at offset 0 from where it is written.

net view /all /domain Enumerates all shared computers and resources on the system and all domains in the network.

net localgroup administrator Enumerates users that are members of the administrator local group. net group "domain admins" /domain Enumerates users that are members of the domain admins group

nltest /domain_trusts /all_trusts Enumerates trust relationships in a Windows Active Directory (AD) environment.

After launching the file, the loader sleeps for some time, then connects to command and control (C&C) servers to check-in and download the payload.

retrieving BazarBackdoor using HTTPS traffic from 104.248.174[.]225 over TCP port 443. Then BazarBackdoor generated C2 activity using HTTPS traffic

Then the BazarLoader will download and install the BazarBackdoor.

The TrickBot’s core team of developers had already created a stealthier piece of malware dubbed BazarBackdoor, used to achieve remote access into corporate networks and use it to deploy the ransomware.

README.md ... Domain Generation Algorithms (DGAs) of Malware reimplemented in Python.

The TrickBot’s core team of developers had already created a stealthier piece of malware dubbed BazarBackdoor, used to achieve remote access into corporate networks and use it to deploy the ransomware.