bazarloader | 081409dbf0464baad30442d3f8cea67c885e15e438b0f6dbf9c64da67620eaa1 | Triage

Analysis

max time kernel
151s
max time network
145s
platform
windows10_x64
resource
win10-en-20210920
submitted
14-10-2021 14:10

Sharing

Report Analysis Logs

General

Target

1.dll
Size

537KB
MD5

efad3e8098fdc4778d1744abb659fb04
SHA1

90e28ff7cc0cc20ae2f10652f9ffda01107470ed
SHA256

081409dbf0464baad30442d3f8cea67c885e15e438b0f6dbf9c64da67620eaa1
SHA512

a203e6084df1fde1f037bf7071a901541cfed9e18f5924c3ee47176bba2256774774fb08214520792b0603aa9784836d58fc55b38c7d987cec8a9d1be8a83783

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2056-115-0x000001AADEE10000-0x000001AADEE3A000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

35 2056 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
1⤵
- Blocklisted process makes network request
PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-115-0x000001AADEE10000-0x000001AADEE3A000-memory.dmp

Filesize
168KB

Download