bazarloader | 7000ec866763706f0244525b0951606dd9a18f3acfb338b13cc8b4ef437a814f

General

Target

myLadyYou.hta
Size

3KB
MD5

c61438c62ed2365acf96666d60693f7f
SHA1

fb6a583b20018529b1a582aefed72610ebee0e15
SHA256

7000ec866763706f0244525b0951606dd9a18f3acfb338b13cc8b4ef437a814f
SHA512

9d11669828022f409f68623a3a29343b11b78d3449b099439f23b1b00785209496776dbae5c7dd310af2306bfb673e9e118dd200a82a7146c51ff716ac694c0c

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1560 created 1252 1560 regsvr32.exe Explorer.EXE

description	pid	process	target process
PID 1560 created 1252	1560	regsvr32.exe	Explorer.EXE

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1560-63-0x0000000180001000-0x0000000180030000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

5 1604 mshta.exe
Downloads MZ/PE file
Loads dropped DLL 3 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exe

pid process

1060 regsvr32.exe
1560 regsvr32.exe
1752 regsvr32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1560 set thread context of 1724 1560 regsvr32.exe chrome.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1560 regsvr32.exe

flow	pid	process
5	1604	mshta.exe

pid	process
1060	regsvr32.exe
1560	regsvr32.exe
1752	regsvr32.exe

description	pid	process	target process
PID 1560 set thread context of 1724	1560	regsvr32.exe	chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
1560	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

mshta.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1604 wrote to memory of 1060	1604	mshta.exe	regsvr32.exe
PID 1604 wrote to memory of 1060	1604	mshta.exe	regsvr32.exe
PID 1604 wrote to memory of 1060	1604	mshta.exe	regsvr32.exe
PID 1604 wrote to memory of 1060	1604	mshta.exe	regsvr32.exe
PID 1604 wrote to memory of 1060	1604	mshta.exe	regsvr32.exe
PID 1604 wrote to memory of 1060	1604	mshta.exe	regsvr32.exe
PID 1604 wrote to memory of 1060	1604	mshta.exe	regsvr32.exe
PID 1060 wrote to memory of 1560	1060	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 1560	1060	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 1560	1060	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 1560	1060	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 1560	1060	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 1560	1060	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 1560	1060	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe
PID 1560 wrote to memory of 1724	1560	regsvr32.exe	chrome.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\myLadyYou.hta"
2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" c:\users\public\youMySea.jpg
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\system32\regsvr32.exe
c:\users\public\youMySea.jpg
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:1724

C:\Windows\system32\regsvr32.exe
regsvr32 /s "c:\users\public\youMySea.jpg"
1⤵
- Loads dropped DLL
PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
f2367de7d784190f0d36f1220771036d

SHA1
a00b58bd39d52184a523d51b1e9755eb5c90bc4b

SHA256
8434f9c98887a64837c57daeea73213ab1b42533bc2030f35e1f360c60a23f7b

SHA512
2d10ae81c44b72d80aefee138f34373252423bdf3cd83edbbab88cb0102c412b3a8ee1ddd50fa16647f086b3fb8a3b744f0fb0134896b25c44f5b106e607d056

Download Submit
\??\c:\users\public\youMySea.jpg
MD5
8b4f5f6d29675254d8569ed9320b7cff

SHA1
dacd5aeba998118fbfd322e1bb717a46f146af56

SHA256
f34d674e784a36cab9db68591f73f5c0f8dc6503bf8f155de9b6745645a89ddd

SHA512
2126cd0f54970c6302619cef2c6df05ddb98b14965c840316161ecde0cf6c4e1f0c75e082396f2084395a4bfd7bbf458145361d029d9751ebded9eaad0b7912c

Download Submit
\Users\Public\youMySea.jpg
MD5
8b4f5f6d29675254d8569ed9320b7cff

SHA1
dacd5aeba998118fbfd322e1bb717a46f146af56

SHA256
f34d674e784a36cab9db68591f73f5c0f8dc6503bf8f155de9b6745645a89ddd

SHA512
2126cd0f54970c6302619cef2c6df05ddb98b14965c840316161ecde0cf6c4e1f0c75e082396f2084395a4bfd7bbf458145361d029d9751ebded9eaad0b7912c

Download Submit
\Users\Public\youMySea.jpg
MD5
8b4f5f6d29675254d8569ed9320b7cff

SHA1
dacd5aeba998118fbfd322e1bb717a46f146af56

SHA256
f34d674e784a36cab9db68591f73f5c0f8dc6503bf8f155de9b6745645a89ddd

SHA512
2126cd0f54970c6302619cef2c6df05ddb98b14965c840316161ecde0cf6c4e1f0c75e082396f2084395a4bfd7bbf458145361d029d9751ebded9eaad0b7912c

Download Submit
\Users\Public\youMySea.jpg
MD5
8b4f5f6d29675254d8569ed9320b7cff

SHA1
dacd5aeba998118fbfd322e1bb717a46f146af56

SHA256
f34d674e784a36cab9db68591f73f5c0f8dc6503bf8f155de9b6745645a89ddd

SHA512
2126cd0f54970c6302619cef2c6df05ddb98b14965c840316161ecde0cf6c4e1f0c75e082396f2084395a4bfd7bbf458145361d029d9751ebded9eaad0b7912c

Download Submit
memory/1060-55-0x0000000000000000-mapping.dmp

Download
memory/1060-56-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download
memory/1560-59-0x0000000000000000-mapping.dmp

Download
memory/1560-60-0x000007FEFBD11000-0x000007FEFBD13000-memory.dmp

Filesize
8KB

Download
memory/1560-62-0x00000000002C0000-0x00000000002E9000-memory.dmp

Filesize
164KB

Download
memory/1560-63-0x0000000180001000-0x0000000180030000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing