Analysis
-
max time kernel
145s -
max time network
194s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-08-2021 16:07
General
-
Target
htmlDefineFunc.jpg.dll
-
Size
254KB
-
MD5
94b1dd32c7b1f7a4d9d0dd7e4c301dd6
-
SHA1
17ec04d523899e9c63645aed68058404dbeeb557
-
SHA256
d384dfdd90da4645a8d74956534cfcef7fcbbf4ed654e61b3d27384616b4bc4a
-
SHA512
4873dfc934f5f58d2ac187af1233ca34f0b04737e0cb9aea8a5639fc1fb413bab1d232d6e56e7b9df6260b07eb87de1a0bd3b7499566220d432ebd4879697a58
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 2 IoCs
-
Tries to connect to .bazar domain 45 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\htmlDefineFunc.jpg.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\htmlDefineFunc.jpg.dll,StartW 18611931171⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/536-61-0x0000000001D10000-0x0000000001E9C000-memory.dmpFilesize
1.5MB
-
memory/1644-59-0x000007FEFBFF1000-0x000007FEFBFF3000-memory.dmpFilesize
8KB
-
memory/1644-60-0x0000000001D30000-0x0000000001EBC000-memory.dmpFilesize
1.5MB