Overview

overview

10

Static

static

zas6.dll

windows7_x64

10

zas6.dll

windows10_x64

10

Analysis

  • max time kernel
    1644s
  • max time network
    1813s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    21-10-2021 13:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    zas6.dll

  • Size

    341KB

  • MD5

    b3006622f08bfedeb4f5abaf7f88bfd8

  • SHA1

    f80ff6d37a5de8eb8715f00bf7db677e647a53ca

  • SHA256

    c1e98cb060bcffb391acc2bf84048ced69cadbe39c4cc65fa4ff793547fed232

  • SHA512

    046450b3a0e28bef598ea57cdfca80e85381a7d8be3fd9f007998be327f85095d61da4d8482675c9a10257d64521fbab98973db9cc5e049e8f8e6965a74af07d

Score
10/10
bazarloaderdropperloadersuricata

Malware Config

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • suricata: ET MALWARE BazaLoader Activity (GET)

    suricata: ET MALWARE BazaLoader Activity (GET)

    suricata
  • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata
  • Bazar/Team9 Loader payload 2 IoCs
  • Tries to connect to .bazar domain 1 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2872
      • C:\Windows\system32\regsvr32.exe
        regsvr32 /s C:\Users\Admin\AppData\Local\Temp\zas6.dll
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3712
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        2⤵
          PID:1680
      • C:\Windows\system32\regsvr32.exe
        regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\zas6.dll"
        1⤵
          PID:1520

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1520-116-0x0000000002B90000-0x0000000002DB6000-memory.dmp
          Filesize

          2.1MB

          Download
        • memory/3712-115-0x0000000002B70000-0x0000000002D96000-memory.dmp
          Filesize

          2.1MB

          Download