bazarloader | 43db644f33e96b7c734f682635fa7a0e5437a65871efe0f04ede0568e19c7c3f

Analysis

Target
Document2-85.exe
Size 5.7MB
Sample201008-drsny2lxta
SHA256 43db644f33e96b7c734f682635fa7a0e5437a65871efe0f04ede0568e19c7c3f
MD5 39f41e479778d55b0fef3e19b6bb7d82
SHA1 bda32ba43f674395ef0d9c175da2cad6aa857229
SHA512 c554dd6f6e738ae0d0a5083c9c0a2ad337cf324f9dd1da3dd18f4e33162726531a52885f5914b43492a87c815d3ff91a58be51d64b3917d6eed6df15a5af13d1
MD5 SHA1 SHA512

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 4 IoCs

resource	yara_rule
behavioral2/memory/3888-0-0x0000000000170000-0x0000000000189000-memory.dmp	BazarLoaderVar1
behavioral2/memory/3888-1-0x0000000180000000-0x0000000180017000-memory.dmp	BazarLoaderVar1
behavioral2/memory/2264-2-0x00007FF72B070000-0x00007FF72B091000-memory.dmp	BazarLoaderVar1
behavioral2/memory/2264-3-0x00007FF72B0721EC-mapping.dmp	BazarLoaderVar1

Blocklisted process makes network request 2 IoCs

flow	pid	Process
14	2264	cmd.exe
15	2264	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3888 set thread context of 2264	3888	Document2-85.exe	75

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3888	Document2-85.exe
3888	Document2-85.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 2264	3888	Document2-85.exe	75
PID 3888 wrote to memory of 2264	3888	Document2-85.exe	75
PID 3888 wrote to memory of 2264	3888	Document2-85.exe	75
PID 3888 wrote to memory of 2264	3888	Document2-85.exe	75
PID 3888 wrote to memory of 2264	3888	Document2-85.exe	75
PID 3888 wrote to memory of 2264	3888	Document2-85.exe	75
PID 3888 wrote to memory of 2264	3888	Document2-85.exe	75

C:\Users\Admin\AppData\Local\Temp\Document2-85.exe
"C:\Users\Admin\AppData\Local\Temp\Document2-85.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  - Blocklisted process makes network request
  PID:2264

memory/2264-2-0x00007FF72B070000-0x00007FF72B091000-memory.dmp

Download

memory/3888-0-0x0000000000170000-0x0000000000189000-memory.dmp

Download

memory/3888-1-0x0000000180000000-0x0000000180017000-memory.dmp

Download