bazarloader | 151e59a2fcb92d740cfd9fa96c1eeb73bf06b8bbdae458260b45fba4fe2e0b48

General

Target
588a3f2c94dde4650de944d6ceb90b81.dll
Size 807KB
Sample210327-9b2navrpjn
SHA256 151e59a2fcb92d740cfd9fa96c1eeb73bf06b8bbdae458260b45fba4fe2e0b48
MD5 588a3f2c94dde4650de944d6ceb90b81
SHA1 2ed911ed9694dc1fbc6940190b6dd8c9684a6594
SHA512 f6a74894759bfbb0366981460bb128033fd5255c231da2c5bb62427589ba8ae2005a2f0199182dfe98486f89b006988e65c35f23270f1be590d819bc1fed6e9b
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader persistence

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 3 IoCs

resource	yara_rule
behavioral2/memory/1048-2-0x000002498AB80000-0x000002498ABAA000-memory.dmp	BazarLoaderVar1
behavioral2/memory/1048-3-0x0000000180000000-0x0000000180026000-memory.dmp	BazarLoaderVar1
behavioral2/memory/1048-4-0x000002498AB50000-0x000002498AB77000-memory.dmp	BazarLoaderVar1

Blocklisted process makes network request 1 IoCs

flow	pid	Process
14	3292	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
3960	rundll32.exe
3292	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\V7W50X1D = "C:\\Windows\\system32\\rundll32.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\HN64D27.dll,StartW HTRQ"	rundll32.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
808	PING.EXE
516	PING.EXE
3880	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1048	rundll32.exe
1048	rundll32.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1524	1048	rundll32.exe	79
PID 1048 wrote to memory of 1524	1048	rundll32.exe	79
PID 1524 wrote to memory of 808	1524	cmd.exe	81
PID 1524 wrote to memory of 808	1524	cmd.exe	81
PID 1524 wrote to memory of 1368	1524	cmd.exe	82
PID 1524 wrote to memory of 1368	1524	cmd.exe	82
PID 1368 wrote to memory of 2100	1368	rundll32.exe	83
PID 1368 wrote to memory of 2100	1368	rundll32.exe	83
PID 2100 wrote to memory of 516	2100	cmd.exe	85
PID 2100 wrote to memory of 516	2100	cmd.exe	85
PID 2100 wrote to memory of 3960	2100	cmd.exe	86
PID 2100 wrote to memory of 3960	2100	cmd.exe	86
PID 3960 wrote to memory of 2696	3960	rundll32.exe	87
PID 3960 wrote to memory of 2696	3960	rundll32.exe	87
PID 2696 wrote to memory of 3880	2696	cmd.exe	89
PID 2696 wrote to memory of 3880	2696	cmd.exe	89
PID 2696 wrote to memory of 3292	2696	cmd.exe	90
PID 2696 wrote to memory of 3292	2696	cmd.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\588a3f2c94dde4650de944d6ceb90b81.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\system32\cmd.exe
  cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\588a3f2c94dde4650de944d6ceb90b81.dll,StartW PN5H97D
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\system32\PING.EXE
    ping 8.8.7.7 -n 2
    3⤵
    - Runs ping.exe
    PID:808
- - C:\Windows\system32\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\588a3f2c94dde4650de944d6ceb90b81.dll,StartW PN5H97D
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\system32\cmd.exe
      cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\HN64D27.dll,StartW J8MI50
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2100
    - - C:\Windows\system32\PING.EXE
        
        ping 8.8.7.7 -n 2
        5⤵
        Runs ping.exe
        
        PID:516
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\HN64D27.dll,StartW J8MI50
        5⤵
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3960
      - C:\Windows\system32\cmd.exe
        
        cmd /c ping 8.8.7.7 -n 2 & start C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\hN64D27.dll,StartW HTRQ
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\system32\PING.EXE
        
        ping 8.8.7.7 -n 2
        7⤵
        Runs ping.exe
        
        PID:3880
        
        C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\hN64D27.dll,StartW HTRQ
        7⤵
        Blocklisted process makes network request
        Loads dropped DLL
        
        PID:3292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-2-0x000002498AB80000-0x000002498ABAA000-memory.dmp

Download

memory/1048-4-0x000002498AB50000-0x000002498AB77000-memory.dmp

Download

memory/1048-3-0x0000000180000000-0x0000000180026000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads