Analysis
- max time kernel
269s - max time network
281s - platform
windows10_x64 - resource
win10v20210408 - submitted
13/10/2021, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
1.dll
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 1.dll
- Size 1.1MB
- Sample211013-mtsl7aeac3
- SHA256 bf58ef24dd79c02522163be7d8e523cecb2be8daf30e98fd6673d583cbc9e74b
- MD5 730ca73a23dd70b2edf3712e4d03db1c
- SHA1 48d8ff863d43bde2614ae387841135d1b33e66da
- SHA512 454b6caad5539489cbbce8efd34a2ec03b6ce38490c6c3d05f18c8825c1d70e98b1efc5974ebf92213c292d782e55abad2e1ddd0130d0ad7d2c33336a1c98f8a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
- Bazar/Team9 Loader payload 1 IoCs
resource yara_rule behavioral2/memory/3492-114-0x0000000180000000-0x000000018002A000-memory.dmp BazarLoaderVar5 - Blocklisted process makes network request 55 IoCs
flow pid Process 31 3492 rundll32.exe 33 3492 rundll32.exe 34 3492 rundll32.exe 35 3492 rundll32.exe 37 3492 rundll32.exe 38 3492 rundll32.exe 40 3492 rundll32.exe 41 3492 rundll32.exe 42 3492 rundll32.exe 43 3492 rundll32.exe 44 3492 rundll32.exe 45 3492 rundll32.exe 46 3492 rundll32.exe 47 3492 rundll32.exe 48 3492 rundll32.exe 49 3492 rundll32.exe 50 3492 rundll32.exe 51 3492 rundll32.exe 52 3492 rundll32.exe 53 3492 rundll32.exe 54 3492 rundll32.exe 55 3492 rundll32.exe 56 3492 rundll32.exe 57 3492 rundll32.exe 58 3492 rundll32.exe 59 3492 rundll32.exe 60 3492 rundll32.exe 61 3492 rundll32.exe 62 3492 rundll32.exe 63 3492 rundll32.exe 64 3492 rundll32.exe 65 3492 rundll32.exe 66 3492 rundll32.exe 67 3492 rundll32.exe 68 3492 rundll32.exe 69 3492 rundll32.exe 70 3492 rundll32.exe 71 3492 rundll32.exe 72 3492 rundll32.exe 73 3492 rundll32.exe 74 3492 rundll32.exe 75 3492 rundll32.exe 76 3492 rundll32.exe 77 3492 rundll32.exe 78 3492 rundll32.exe 79 3492 rundll32.exe 80 3492 rundll32.exe 81 3492 rundll32.exe 82 3492 rundll32.exe 83 3492 rundll32.exe 84 3492 rundll32.exe 85 3492 rundll32.exe 86 3492 rundll32.exe 87 3492 rundll32.exe 88 3492 rundll32.exe - Tries to connect to .bazar domain 49 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
flow ioc 52 reddew28c.bazar 54 reddew28c.bazar 58 bluehail.bazar 59 bluehail.bazar 66 bluehail.bazar 82 whitestorm9p.bazar 50 reddew28c.bazar 47 reddew28c.bazar 51 reddew28c.bazar 56 reddew28c.bazar 57 bluehail.bazar 62 bluehail.bazar 69 bluehail.bazar 70 bluehail.bazar 45 reddew28c.bazar 72 bluehail.bazar 55 reddew28c.bazar 71 bluehail.bazar 74 whitestorm9p.bazar 80 whitestorm9p.bazar 87 whitestorm9p.bazar 49 reddew28c.bazar 44 reddew28c.bazar 48 reddew28c.bazar 53 reddew28c.bazar 61 bluehail.bazar 64 bluehail.bazar 68 bluehail.bazar 78 whitestorm9p.bazar 43 reddew28c.bazar 76 whitestorm9p.bazar 77 whitestorm9p.bazar 81 whitestorm9p.bazar 41 reddew28c.bazar 67 bluehail.bazar 73 whitestorm9p.bazar 79 whitestorm9p.bazar 86 whitestorm9p.bazar 88 whitestorm9p.bazar 65 bluehail.bazar 42 reddew28c.bazar 60 bluehail.bazar 75 whitestorm9p.bazar 37 blackrain15.bazar 63 bluehail.bazar 83 whitestorm9p.bazar 84 whitestorm9p.bazar 85 whitestorm9p.bazar 46 reddew28c.bazar