bazarloader | 7000ec866763706f0244525b0951606dd9a18f3acfb338b13cc8b4ef437a814f

General

Target

myLadyYou.hta
Size

3KB
MD5

c61438c62ed2365acf96666d60693f7f
SHA1

fb6a583b20018529b1a582aefed72610ebee0e15
SHA256

7000ec866763706f0244525b0951606dd9a18f3acfb338b13cc8b4ef437a814f
SHA512

9d11669828022f409f68623a3a29343b11b78d3449b099439f23b1b00785209496776dbae5c7dd310af2306bfb673e9e118dd200a82a7146c51ff716ac694c0c

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1520 created 3040 1520 regsvr32.exe Explorer.EXE

description	pid	process	target process
PID 1520 created 3040	1520	regsvr32.exe	Explorer.EXE

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1520-120-0x0000000180001000-0x0000000180030000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

11 3088 mshta.exe
Downloads MZ/PE file
Loads dropped DLL 3 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exe

pid process

3948 regsvr32.exe
1520 regsvr32.exe
2092 regsvr32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1520 set thread context of 2628 1520 regsvr32.exe chrome.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1520 regsvr32.exe
1520 regsvr32.exe

flow	pid	process
11	3088	mshta.exe

pid	process
3948	regsvr32.exe
1520	regsvr32.exe
2092	regsvr32.exe

description	pid	process	target process
PID 1520 set thread context of 2628	1520	regsvr32.exe	chrome.exe

pid	process
1520	regsvr32.exe
1520	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

mshta.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 3088 wrote to memory of 3948	3088	mshta.exe	regsvr32.exe
PID 3088 wrote to memory of 3948	3088	mshta.exe	regsvr32.exe
PID 3088 wrote to memory of 3948	3088	mshta.exe	regsvr32.exe
PID 3948 wrote to memory of 1520	3948	regsvr32.exe	regsvr32.exe
PID 3948 wrote to memory of 1520	3948	regsvr32.exe	regsvr32.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe
PID 1520 wrote to memory of 2628	1520	regsvr32.exe	chrome.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3040

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\myLadyYou.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
2⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3088

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" c:\users\public\youMySea.jpg
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3948

C:\Windows\system32\regsvr32.exe
c:\users\public\youMySea.jpg
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:2628

C:\Windows\system32\regsvr32.exe
regsvr32 /s "c:\users\public\youMySea.jpg"
1⤵
- Loads dropped DLL
PID:2092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\users\public\youMySea.jpg
MD5
1d0815559388075926b324e3cb0227ce

SHA1
247c5ff8ac3b8a4cfda09edf1a6b7435a7bc4bee

SHA256
ad2c77b2dfe28482b692d9203a046cb2ba8cad05c1677158b3cb07db026aa3ef

SHA512
9f65763012344e937b41755d82a8213d3b41707854dfdbed84f334adc9ed7db1188b18e7b30a616da1ac01820772cc195e0c3691df0876fb5e84add5ec14e2ab

Download Submit
\Users\Public\youMySea.jpg
MD5
1d0815559388075926b324e3cb0227ce

SHA1
247c5ff8ac3b8a4cfda09edf1a6b7435a7bc4bee

SHA256
ad2c77b2dfe28482b692d9203a046cb2ba8cad05c1677158b3cb07db026aa3ef

SHA512
9f65763012344e937b41755d82a8213d3b41707854dfdbed84f334adc9ed7db1188b18e7b30a616da1ac01820772cc195e0c3691df0876fb5e84add5ec14e2ab

Download Submit
\Users\Public\youMySea.jpg
MD5
1d0815559388075926b324e3cb0227ce

SHA1
247c5ff8ac3b8a4cfda09edf1a6b7435a7bc4bee

SHA256
ad2c77b2dfe28482b692d9203a046cb2ba8cad05c1677158b3cb07db026aa3ef

SHA512
9f65763012344e937b41755d82a8213d3b41707854dfdbed84f334adc9ed7db1188b18e7b30a616da1ac01820772cc195e0c3691df0876fb5e84add5ec14e2ab

Download Submit
\Users\Public\youMySea.jpg
MD5
1d0815559388075926b324e3cb0227ce

SHA1
247c5ff8ac3b8a4cfda09edf1a6b7435a7bc4bee

SHA256
ad2c77b2dfe28482b692d9203a046cb2ba8cad05c1677158b3cb07db026aa3ef

SHA512
9f65763012344e937b41755d82a8213d3b41707854dfdbed84f334adc9ed7db1188b18e7b30a616da1ac01820772cc195e0c3691df0876fb5e84add5ec14e2ab

Download Submit
memory/1520-118-0x0000000000000000-mapping.dmp

Download
memory/1520-120-0x0000000180001000-0x0000000180030000-memory.dmp

Filesize
188KB

Download
memory/3948-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing