Analysis
- max time kernel
98s - max time network
126s - platform
windows10_x64 - resource
win10v20210408 - submitted
28/09/2021, 06:26
Static task
static1
Behavioral task
behavioral1
Sample
2563382a0ba552afc0ad8571a6815f6d.dll
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2563382a0ba552afc0ad8571a6815f6d.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 2563382a0ba552afc0ad8571a6815f6d.dll
- Size 1.3MB
- Sample210928-g68ahsagh6
- SHA256 8542e790264aead4545ac9debccff734d9dbe33993c5a419361befb87ea4a79a
- MD5 2563382a0ba552afc0ad8571a6815f6d
- SHA1 108c4f426968e5e1f00a61499506126ee2ef197f
- SHA512 80845ffbd9c934f7569dbb470184b56508fd9a9d5df129a25bbe80394bf7142e696b0a471c451f929029f85b9184472ce2d8a9f622ff403b37c8962d3eee7d73
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
- Bazar/Team9 Loader payload 1 IoCs
resource yara_rule behavioral2/memory/776-114-0x0000000180000000-0x0000000180019000-memory.dmp BazarLoaderVar6 - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 776 set thread context of 924 776 regsvr32.exe 76 - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 776 regsvr32.exe 776 regsvr32.exe 776 regsvr32.exe 776 regsvr32.exe 776 regsvr32.exe 776 regsvr32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76 PID 776 wrote to memory of 924 776 regsvr32.exe 76
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2563382a0ba552afc0ad8571a6815f6d.dll1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup2⤵PID:924
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2563382a0ba552afc0ad8571a6815f6d.dll,DllRegisterServer {135B95D2-5AEA-4A09-A098-3F0BBF9BF782}1⤵PID:872