Analysis
- max time kernel
152s - max time network
153s - platform
windows10_x64 - resource
win10v20210408 - submitted
13/10/2021, 09:42
Static task
static1
Behavioral task
behavioral1
Sample
1.dll
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 1.dll
- Size 1.1MB
- Sample211013-lpc59sdhe8
- SHA256 bf58ef24dd79c02522163be7d8e523cecb2be8daf30e98fd6673d583cbc9e74b
- MD5 730ca73a23dd70b2edf3712e4d03db1c
- SHA1 48d8ff863d43bde2614ae387841135d1b33e66da
- SHA512 454b6caad5539489cbbce8efd34a2ec03b6ce38490c6c3d05f18c8825c1d70e98b1efc5974ebf92213c292d782e55abad2e1ddd0130d0ad7d2c33336a1c98f8a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
- Bazar/Team9 Loader payload 1 IoCs
resource yara_rule behavioral2/memory/1400-114-0x0000000180000000-0x000000018002A000-memory.dmp BazarLoaderVar5 - Blocklisted process makes network request 20 IoCs
flow pid Process 29 1400 rundll32.exe 30 1400 rundll32.exe 31 1400 rundll32.exe 33 1400 rundll32.exe 34 1400 rundll32.exe 35 1400 rundll32.exe 37 1400 rundll32.exe 38 1400 rundll32.exe 39 1400 rundll32.exe 40 1400 rundll32.exe 41 1400 rundll32.exe 42 1400 rundll32.exe 43 1400 rundll32.exe 44 1400 rundll32.exe 45 1400 rundll32.exe 46 1400 rundll32.exe 47 1400 rundll32.exe 48 1400 rundll32.exe 49 1400 rundll32.exe 50 1400 rundll32.exe - Tries to connect to .bazar domain 8 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
flow ioc 39 reddew28c.bazar 40 reddew28c.bazar 41 reddew28c.bazar 42 reddew28c.bazar 43 reddew28c.bazar 44 reddew28c.bazar 34 blackrain15.bazar 38 reddew28c.bazar