bazarloader | bcea99b1ec6fa52fec60589878c451266f260a8b4e2d8c85d700b3d24e0dce4b

Target
PreviewDoc.exe
Size 506KB
Sample201210-y8eh5tnflx
SHA256 bcea99b1ec6fa52fec60589878c451266f260a8b4e2d8c85d700b3d24e0dce4b
MD5 4e0da1ea4579f0bed86d480ab65a2010
SHA1 2224403a67ef396718f3087c47521c8075d0f687
SHA512 f8aa78fecbf11a8c9379bd12a3972b466cdcf73d25623a0f5c87b3e8fd1215be51c2d369da8c010bdf428d9f472f390655f2030a285a1c2967327917503a8264
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

resource	yara_rule
behavioral2/memory/984-2-0x00000000008E0000-0x0000000000928000-memory.dmp	BazarLoaderVar3
behavioral2/memory/984-3-0x0000000001F50000-0x0000000001F99000-memory.dmp	BazarLoaderVar3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 984 set thread context of 2720	984	PreviewDoc.exe	78

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 2720	984	PreviewDoc.exe	78
PID 984 wrote to memory of 2720	984	PreviewDoc.exe	78
PID 984 wrote to memory of 2720	984	PreviewDoc.exe	78
PID 984 wrote to memory of 2720	984	PreviewDoc.exe	78
PID 984 wrote to memory of 2720	984	PreviewDoc.exe	78
PID 984 wrote to memory of 2720	984	PreviewDoc.exe	78
PID 984 wrote to memory of 2720	984	PreviewDoc.exe	78
PID 984 wrote to memory of 2720	984	PreviewDoc.exe	78
PID 984 wrote to memory of 2720	984	PreviewDoc.exe	78
PID 984 wrote to memory of 2720	984	PreviewDoc.exe	78

C:\Users\Admin\AppData\Local\Temp\PreviewDoc.exe
"C:\Users\Admin\AppData\Local\Temp\PreviewDoc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" -sf "C:\Users\Admin\AppData\Local\Temp\PreviewDoc.exe"
  2⤵
  PID:2720

memory/984-2-0x00000000008E0000-0x0000000000928000-memory.dmp

Download

memory/984-3-0x0000000001F50000-0x0000000001F99000-memory.dmp

Download

memory/2720-4-0x0000000140000000-0x0000000140083000-memory.dmp

Download