bazarloader | bcea99b1ec6fa52fec60589878c451266f260a8b4e2d8c85d700b3d24e0dce4b

Target
PreviewDoc.exe
Size 506KB
Sample201210-kdnjenxb5s
SHA256 bcea99b1ec6fa52fec60589878c451266f260a8b4e2d8c85d700b3d24e0dce4b
MD5 4e0da1ea4579f0bed86d480ab65a2010
SHA1 2224403a67ef396718f3087c47521c8075d0f687
SHA512 f8aa78fecbf11a8c9379bd12a3972b466cdcf73d25623a0f5c87b3e8fd1215be51c2d369da8c010bdf428d9f472f390655f2030a285a1c2967327917503a8264
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 3 IoCs

resource	yara_rule
behavioral1/memory/800-3-0x0000000001DA0000-0x0000000001DE9000-memory.dmp	BazarLoaderVar3
behavioral1/memory/800-2-0x0000000001D50000-0x0000000001D98000-memory.dmp	BazarLoaderVar3
behavioral1/memory/1524-8-0x0000000002790000-0x00000000027D9000-memory.dmp	BazarLoaderVar3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 800 set thread context of 1524	800	PreviewDoc.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1524	800	PreviewDoc.exe	29
PID 800 wrote to memory of 1524	800	PreviewDoc.exe	29
PID 800 wrote to memory of 1524	800	PreviewDoc.exe	29
PID 800 wrote to memory of 1524	800	PreviewDoc.exe	29
PID 800 wrote to memory of 1524	800	PreviewDoc.exe	29
PID 800 wrote to memory of 1524	800	PreviewDoc.exe	29
PID 800 wrote to memory of 1524	800	PreviewDoc.exe	29
PID 800 wrote to memory of 1524	800	PreviewDoc.exe	29
PID 800 wrote to memory of 1524	800	PreviewDoc.exe	29
PID 800 wrote to memory of 1524	800	PreviewDoc.exe	29
PID 800 wrote to memory of 1524	800	PreviewDoc.exe	29

C:\Users\Admin\AppData\Local\Temp\PreviewDoc.exe
"C:\Users\Admin\AppData\Local\Temp\PreviewDoc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" -sf "C:\Users\Admin\AppData\Local\Temp\PreviewDoc.exe"
  2⤵
  PID:1524

memory/800-3-0x0000000001DA0000-0x0000000001DE9000-memory.dmp

Download

memory/800-2-0x0000000001D50000-0x0000000001D98000-memory.dmp

Download

memory/1524-4-0x0000000140000000-0x0000000140083000-memory.dmp

Download

memory/1524-6-0x0000000140000000-0x0000000140083000-memory.dmp

Download

memory/1524-8-0x0000000002790000-0x00000000027D9000-memory.dmp

Download