bazarloader | aa2cb7c438568cb9baf184532b6bda4677cd3bb9f22f8d3e65e22588eeace26f

General

Target

465f6a6e834f601b59cc11bfec695c84.dll
Size

341KB
MD5

465f6a6e834f601b59cc11bfec695c84
SHA1

b08eb122bd1943335c27e1be854df0ad68d96a41
SHA256

aa2cb7c438568cb9baf184532b6bda4677cd3bb9f22f8d3e65e22588eeace26f
SHA512

7023005011c75a9bb99c3877677090e248417b969a428df76f27bc933dd068e1a4a4ce7b062e3967701f7521fa1b3ce3d07516ed06418498e9480cd3e0f359a7

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 584 created 2800 584 regsvr32.exe Explorer.EXE

description	pid	process	target process
PID 584 created 2800	584	regsvr32.exe	Explorer.EXE

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/584-115-0x0000000002B10000-0x0000000002D36000-memory.dmp	BazarLoaderVar5

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 584 set thread context of 2336 584 regsvr32.exe chrome.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

584 regsvr32.exe
584 regsvr32.exe

description	pid	process	target process
PID 584 set thread context of 2336	584	regsvr32.exe	chrome.exe

pid	process
584	regsvr32.exe
584	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe
PID 584 wrote to memory of 2336	584	regsvr32.exe	chrome.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2800

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\465f6a6e834f601b59cc11bfec695c84.dll
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-115-0x0000000002B10000-0x0000000002D36000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads