BAZARLOADER INFECTION WITH COBALT STRIKE (2022-02-04) (34X)

显示全部楼层 · 发表于 2022-2-5 13:45:01

BAZARLOADER INFECTION WITH COBALT STRIKE (2022-02-04)

显示全部楼层 · 发表于 2022-2-5 14:26:12

NICO-COOPER 发表于 2022-2-5 14:20
Intego扫描清空exe，上传云分析，APC报法，剩余html双击报错

INFECTION CHAIN

- email --> zip attachment --> extracted HTA file --> web traffic --> BazarLoader EXE --> Bazar C2 --> Cobalt Strike activity

Shown above: One of the HTA files opened in a text editor.

显示全部楼层 · 发表于 2022-2-5 13:51:27

本帖最后由 hipoxiaxxx 于 2022-2-5 14:02 编辑

飞塔26x，hta kill all，exe kill 2x

显示全部楼层 · 发表于 2022-2-5 13:56:42

McAfee(only DAT)：24/34≈71%

扫描由McAfee邮件上报系统自动进行

McAfee Labs - Beaverton
Current Scan Engine Version:6100.8979
Current DAT Version:10248.0000
Thank you for your submission.

Analysis ID: 11090417

File Name          Findings                      Detection                   Type       Extra
--------------------|------------------------------|----------------------------|------------|-----
antrag-394-394.hta  |detection escalated          |vbs/downloader.aaz       |Trojan    |no
antrag-534-534.hta  |detection escalated          |vbs/downloader.aaz       |Trojan    |no
antrag-809-809.hta  |detection escalated          |vbs/downloader.aaz       |Trojan    |no
antrag-944-944.hta  |detection escalated          |vbs/downloader.aaz       |Trojan    |no
auftrag-1242-1242.ht|detection escalated          |vbs/downloader.aaz       |Trojan    |no
auftrag-1391-1391.ht|detection escalated          |vbs/downloader.aaz       |Trojan    |no
auftrag-1731-1731.ht|detection escalated          |vbs/downloader.aaz       |Trojan    |no
auftrag-2674-2674.ht|detection escalated          |vbs/downloader.aaz       |Trojan    |no
auftrag-2850-2850.ht|detection escalated          |vbs/downloader.aaz       |Trojan    |no
auftrag-2858-2858.ht|detection escalated          |vbs/downloader.aaz       |Trojan    |no
auftrag-396-396.hta |detection escalated          |vbs/downloader.aaz       |Trojan    |no
auftrag-406-406.hta |detection escalated          |vbs/downloader.aaz       |Trojan    |no
auftrag-61-61.hta |detection escalated          |vbs/downloader.aaz       |Trojan    |no
auftrag-631-631.hta |detection escalated          |vbs/downloader.aaz       |Trojan    |no
auftrag-693-693.hta |detection escalated          |vbs/downloader.aaz       |Trojan    |no
auftrag-746-746.hta |detection escalated          |vbs/downloader.aaz       |Trojan    |no
auftrag-964-964.hta |detection escalated          |vbs/downloader.aaz       |Trojan    |no
cufniru.exe       |inconclusive                |                         |          |no
fhtkrl.exe       |inconclusive                |                         |          |no
jeyrthxd.exe       |inconclusive                |                         |          |no
kzwsmdl.exe       |inconclusive                |                         |          |no
qzsldg.exe       |inconclusive                |                         |          |no
rechnung_16148809.ht|detection escalated          |vbs/downloader.aaz       |Trojan    |no
rechnung_16654897.ht|detection escalated          |vbs/downloader.aaz       |Trojan    |no
rechnung_19047313.ht|detection escalated          |vbs/downloader.aaz       |Trojan    |no
rechnung_33524497.ht|detection escalated          |vbs/downloader.aaz       |Trojan    |no
rechnung_35303473.ht|detection escalated          |vbs/downloader.aaz       |Trojan    |no
rechnung_5536297.hta|detection escalated          |vbs/downloader.aaz       |Trojan    |no
rechnung_8695513.hta|detection escalated          |vbs/downloader.aaz       |Trojan    |no
scudx.exe          |inconclusive                |                         |          |no
ujhmjfpd.exe       |inconclusive                |                         |          |no
waxku.exe          |inconclusive                |                         |          |no
ymgih.exe          |inconclusive                |                         |          |no
ymprj.exe          |inconclusive                |                         |          |no

inconclusive [cufniru.exe fhtkrl.exe jeyrthxd.exe kzwsmdl.exe qzsldg.exe scudx.exe ujhmjfpd.exe
waxku.exe ymgih.exe ymprj.exe]

Automated analysis was not able to determine that this file is malware. This file is
being sent for further processing and the DAT files will potentially be updated if
detection of this sample is warranted.

detection escalated [antrag-394-394.hta antrag-534-534.hta antrag-809-809.hta antrag-944-944.hta
auftrag-1242-1242.hta auftrag-1391-1391.hta auftrag-1731-1731.hta
auftrag-2674-2674.hta auftrag-2850-2850.hta auftrag-2858-2858.hta auftrag-396-396.hta
auftrag-406-406.hta auftrag-61-61.hta auftrag-631-631.hta auftrag-693-693.hta
auftrag-746-746.hta auftrag-964-964.hta rechnung_16148809.hta rechnung_16654897.hta
rechnung_19047313.hta rechnung_33524497.hta rechnung_35303473.hta rechnung_5536297.hta
rechnung_8695513.hta]

The file submitted may be malware. This file is being sent for further processing and
the DAT files will potentially be updated if detection of this sample is warranted.

Note –

Due to the prevalence of network gateway AV products, it is important that all
submissions be zipped and the zip file password-protected (password - infected). Some
products will reject an email that contains a virus that is not sent in this way. In
addition, often we receive a file that appears not to have been infected, to find
later that the file was infected when it left the sender, and was cleaned somewhere
along the line.

Regards,

McAfee Labs

显示全部楼层 · 发表于 2022-2-5 13:59:42

火绒

显示全部楼层 · 发表于 2022-2-5 14:07:26

360 kill 24x

显示全部楼层 · 发表于 2022-2-5 14:20:27

本帖最后由 NICO-COOPER 于 2022-2-5 14:27 编辑

Intego扫描清空exe，上传云分析，APC报法，剩余html双击报错。重新解压试了一遍，双击html会触发所谓的“主动防御引擎”进行拦截

显示全部楼层 · 发表于 2022-2-5 14:29:01

00006666 发表于 2022-2-5 14:26
INFECTION CHAIN

- email --> zip attachment --> extracted HTA file --> web traffic --> BazarLoad ...

我刚才重新测了一遍，触发了主动防御引擎

显示全部楼层 · 发表于 2022-2-5 14:51:38

ESET清空

显示全部楼层 · 发表于 2022-2-5 14:56:56

Shake2333 发表于 2022-2-5 14:51
ESET清空

ESET的扫描确实挺强的诶，那几个EXE样本很少有检出的。

[病毒样本] BAZARLOADER INFECTION WITH COBALT STRIKE (2022-02-04) (34X)

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源