bazarloader | 7fbde30e24755e328101e5705cfd1673dc8653ec17fe23fbbccb21b2accc66bd | Triage™

Resubmissions

20/10/2021, 09:24

211020-ldcelahgej10

20/10/2021, 06:32

211020-haz5psgff510

19/10/2021, 23:27

211019-3fefeahdbm10

Analysis

max time kernel
95s
max time network
152s
platform
windows10_x64
resource
win10-en-20211014
submitted
19/10/2021, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7fbde30e24755e328101e5705cfd1673dc8653ec17fe23fbbccb21b2accc66bd.dll
Size 497KB
Sample211019-3fefeahdbm
SHA256 7fbde30e24755e328101e5705cfd1673dc8653ec17fe23fbbccb21b2accc66bd
MD5 7c8cb852b333986ff59da438533975ed
SHA1 cd17f87ecccd8f2e834e98d380a6447e15552467
SHA512 1209377412de2b7d0ca2000a71ebcc178e006510e600a7fafa4e05a31d4801b0215d252b1aebea9c919fde9e8bea8f5cf918f0053c86d81b5c91422d8f7bcbe7
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader suricata

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
suricata: ET MALWARE BazaLoader Activity (GET)
suricata: ET MALWARE BazaLoader Activity (GET)
suricata

Bazar/Team9 Loader payload 1 IoCs

resource	yara_rule
behavioral2/memory/2960-115-0x0000021F227B0000-0x0000021F227DA000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 1 IoCs

flow	pid	Process
28	2960	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7fbde30e24755e328101e5705cfd1673dc8653ec17fe23fbbccb21b2accc66bd.dll,#1
1⤵
- Blocklisted process makes network request
PID:2960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2960-115-0x0000021F227B0000-0x0000021F227DA000-memory.dmp

Download