Bazar

Malware & Tools · Bazar

· MalwareS0534 · Zararlı Yazılım

Type

malware

Techniques

Used By

2 groups

Platforms

Windows

Description

Bazar is a downloader and backdoor that has been used since at least April 2020, with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe. Bazar reportedly has ties to TrickBot campaigns and can be used to deploy additional malware, including ransomware, and to steal sensitive data.(Citation: Cybereason Bazar July 2020)

Tactic Coverage

discovery (17)stealth (15)command and control (8)execution (7)privilege escalation (7)persistence (5)defense impairment (2)collection (1)initial access (1)

Used By (2 groups)

G1011EXOTIC LILY G0102Wizard SpiderUNC1878, TEMP.MixMaster

Techniques (51)

T1005Data from Local System

collection

T1008Fallback Channels

command and control

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1018Remote System Discovery

discovery

T1027.002Software Packing

stealth

T1027.007Dynamic API Resolution

References

https://attack.mitre.org/software/S0534 https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/https://www.crowdstrike.com/blog/wizard-spider-adversary-update/

T1027.013Encrypted/Encoded File

stealth

T1033System Owner/User Discovery

discovery

T1036.004Masquerade Task or Service

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1036.007Double File Extension

stealth

T1047Windows Management Instrumentation

execution

T1053.005Scheduled Task

executionpersistence

T1055Process Injection

stealthprivilege escalation

T1055.012Process Hollowing

stealthprivilege escalation

T1055.013Process Doppelgänging

stealthprivilege escalation

T1057Process Discovery

discovery

T1059.001PowerShell

execution

T1059.003Windows Command Shell

execution

T1070.004File Deletion

stealth

T1070.009Clear Persistence

stealth

T1071.001Web Protocols

command and control

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1087.001Local Account

discovery

T1087.002Domain Account

discovery

T1102Web Service

command and control

T1104Multi-Stage Channels

command and control

T1105Ingress Tool Transfer

command and control

T1106Native API

execution

T1124System Time Discovery

discovery

T1135Network Share Discovery

discovery

T1140Deobfuscate/Decode Files or Information

stealth

T1197BITS Jobs

stealthpersistence

T1204.001Malicious Link

execution

T1482Domain Trust Discovery

discovery

T1497Virtualization/Sandbox Evasion

stealthdiscovery

T1497.003Time Based Checks

stealthdiscovery

T1518Software Discovery

discovery

T1518.001Security Software Discovery

discovery

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

T1547.004Winlogon Helper DLL

persistenceprivilege escalation

T1547.009Shortcut Modification

persistenceprivilege escalation

T1553.002Code Signing

defense impairment

T1566.002Spearphishing Link

initial access

T1568.002Domain Generation Algorithms

command and control

T1573.001Symmetric Cryptography

command and control

T1573.002Asymmetric Cryptography

command and control

T1614.001System Language Discovery

discovery

T1685Disable or Modify Tools

defense impairment