bazarloader | c1e98cb060bcffb391acc2bf84048ced69cadbe39c4cc65fa4ff793547fed232

General

Target

zas6.dll
Size

341KB
MD5

b3006622f08bfedeb4f5abaf7f88bfd8
SHA1

f80ff6d37a5de8eb8715f00bf7db677e647a53ca
SHA256

c1e98cb060bcffb391acc2bf84048ced69cadbe39c4cc65fa4ff793547fed232
SHA512

046450b3a0e28bef598ea57cdfca80e85381a7d8be3fd9f007998be327f85095d61da4d8482675c9a10257d64521fbab98973db9cc5e049e8f8e6965a74af07d

Score

10^/10

bazarloader dropper loader suricata

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1668 created 1288 1668 regsvr32.exe Explorer.EXE
suricata: ET MALWARE BazaLoader Activity (GET)
suricata: ET MALWARE BazaLoader Activity (GET)
suricata
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

description	pid	process	target process
PID 1668 created 1288	1668	regsvr32.exe	Explorer.EXE

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1668-55-0x0000000001F00000-0x0000000002126000-memory.dmp	BazarLoaderVar5
behavioral1/memory/1952-59-0x0000000001E70000-0x0000000002096000-memory.dmp	BazarLoaderVar5

Tries to connect to .bazar domain 1 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow ioc

36 blackrain15.bazar
Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1668 set thread context of 1084 1668 regsvr32.exe chrome.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1668 regsvr32.exe

flow	ioc
36	blackrain15.bazar

description	pid	process	target process
PID 1668 set thread context of 1084	1668	regsvr32.exe	chrome.exe

pid	process
1668	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe
PID 1668 wrote to memory of 1084	1668	regsvr32.exe	chrome.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1288

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\zas6.dll
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:1084

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
2⤵
PID:1160

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\zas6.dll"
1⤵
PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
ab5c36d10261c173c5896f3478cdc6b7

SHA1
87ac53810ad125663519e944bc87ded3979cbee4

SHA256
f8e90fb0557fe49d7702cfb506312ac0b24c97802f9c782696db6d47f434e8e9

SHA512
e83e4eae44e7a9cbcd267dbfc25a7f4f68b50591e3bbe267324b1f813c9220d565b284994ded5f7d2d371d50e1ebfa647176ec8de9716f754c6b5785c6e897fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
ab79c73e5c785970c196b2713eacb709

SHA1
8379da5206177ee4848d725e7e961bb6b3c31c1f

SHA256
00b97323db2091c9776bf82f2fca4c973ed1e79ccb49afe6b5d2fb0e2b39bcfc

SHA512
e9479acf1763f29191e74e23438494231240822ffa27de024be96abcc31f4c5c05e795cc16c2dd7928b39a56ec7bad6948d6087e2fd6a61372a1297ef1bbb581

Download Submit
memory/1668-54-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download
memory/1668-55-0x0000000001F00000-0x0000000002126000-memory.dmp

Filesize
2.1MB

Download
memory/1952-59-0x0000000001E70000-0x0000000002096000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads