Analysis
- max time kernel
146s - max time network
151s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
28/09/2021, 06:26
Static task
static1
Behavioral task
behavioral1
Sample
0fc9979f699e47762f0eeb3054b641bd.dll
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0fc9979f699e47762f0eeb3054b641bd.dll
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
- Target 0fc9979f699e47762f0eeb3054b641bd.dll
- Size 1.3MB
- Sample210928-g68ahsagh7
- SHA256 323fb5f9e95ef64d5798c6f6948d1dca562232a8918a0c7e7d966d573d5c1918
- MD5 0fc9979f699e47762f0eeb3054b641bd
- SHA1 53ac79eee702131072ee7038b67fd3e135e3167b
- SHA512 c56b0b00a7baf5f6fbd0e54bcee8918df4f4ad796ccef280edabb3143ae441f8d7c95609c9092dd67cd6cc82903eb3554fc5c0289ab921d98bb115cc77acba7b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
- Bazar/Team9 Loader payload 1 IoCs
resource yara_rule behavioral2/memory/2396-115-0x0000000180000000-0x0000000180019000-memory.dmp BazarLoaderVar6 - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2396 set thread context of 4080 2396 regsvr32.exe 73 - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2396 regsvr32.exe 2396 regsvr32.exe 2396 regsvr32.exe 2396 regsvr32.exe 2396 regsvr32.exe 2396 regsvr32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73 PID 2396 wrote to memory of 4080 2396 regsvr32.exe 73
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0fc9979f699e47762f0eeb3054b641bd.dll1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup2⤵PID:4080
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fc9979f699e47762f0eeb3054b641bd.dll,DllRegisterServer {CA9580B3-9EBA-4393-9C70-779E213F993A}1⤵PID:2716