bazarloader | 2b4cb47f7eaf92391b2f59955771d0ef2c97e5dfe4b5087fbe2db57fe11f045a | Triage

Analysis

max time kernel
131s
max time network
180s
platform
windows7_x64
resource
win7-en-20210920
submitted
15-10-2021 22:22

Sharing

Report Analysis Logs

General

Target

1.dll
Size

539KB
MD5

0fd8135a2957037c52811df5f68ddf22
SHA1

448630a1dea594d373c03b9ff6b48b70e68442b5
SHA256

04addd98627d2e486b64aa9e61598d85c4501c2865313144cc7e1c668bd34ef8
SHA512

1069bc169bdceeea1e4c63b622c9408b116dbabb990f29b2fa29352e3dca3b94520e43b21a0ba641720ffce919a4063560f68884730e6f6a2587996a1c49b3b9

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1120-54-0x00000000002C0000-0x00000000002EA000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

4 1120 rundll32.exe
5 1120 rundll32.exe
6 1120 rundll32.exe
7 1120 rundll32.exe
8 1120 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
1⤵
- Blocklisted process makes network request
PID:1120

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-54-0x00000000002C0000-0x00000000002EA000-memory.dmp

Filesize
168KB

Download
memory/1820-55-0x000007FEFBFC1000-0x000007FEFBFC3000-memory.dmp

Filesize
8KB

Download