bazarloader | c6c49487b97174cf00ebc3a28b15e27f9c8cfbb57294cb588e67603322581ea8

General

Target

Documents.lnk
Size

1KB
MD5

4d8af5ba95aa23f7162b7bbf8622d801
SHA1

d5b8c1a219686be5b75e58c560609023b491d9aa
SHA256

e87f9f378590b95de1b1ef2aaab84e1d00f210fd6aaf5025d815f33096c9d162
SHA512

f64416dbce111afe375efe031b05ed5b5b5c00c956d3c419d733147e4f0e751a60f3a22c72c36d45841abf85013c9647c6dc040cdd3d56c9b8cc35bccfd60d2c

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1484 created 1204 1484 rundll32.exe Explorer.EXE

description	pid	process	target process
PID 1484 created 1204	1484	rundll32.exe	Explorer.EXE

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1484-58-0x0000000180001000-0x000000018002E000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

4 1484 rundll32.exe
6 1484 rundll32.exe
7 1484 rundll32.exe

flow	pid	process
4	1484	rundll32.exe
6	1484	rundll32.exe
7	1484	rundll32.exe

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
144	tyibuhed.bazar
250	fusouhem.bazar
904	lieluhem.bazar
947	aqtowyem.bazar
1217	futowyom.bazar
277	aquheked.bazar
886	tuuhwyom.bazar
1052	ypcawyom.bazar
1293	owudwyem.bazar
1344	vueduhed.bazar
339	ydekided.bazar
700	ydcuwyom.bazar
891	fuacided.bazar
1279	ydywidyw.bazar
531	tuqeided.bazar
1227	futowyom.bazar
1273	ydywidyw.bazar
1354	izqewyyw.bazar
292	owacidyw.bazar
696	ydcuwyom.bazar
723	agidided.bazar
853	ehemeked.bazar
1025	exudwyyw.bazar
1380	yponidem.bazar
1396	izsoekyw.bazar
522	tyedwyom.bazar
604	aqacidom.bazar
644	biekekyw.bazar
813	etedwyed.bazar
154	tyibuhed.bazar
302	owacidyw.bazar
317	bielwyem.bazar
343	ydekided.bazar
401	agcuwyyw.bazar
426	vuididom.bazar
631	iqelwyed.bazar
943	biewuhed.bazar
1128	etsoidom.bazar
1288	owudwyem.bazar
1306	exwyided.bazar
1341	vueduhed.bazar
1092	etqeekom.bazar
248	iqemekyw.bazar
412	agcuwyyw.bazar
434	izywwyed.bazar
585	tusouhed.bazar
670	owtoeked.bazar
725	vuywuhem.bazar
747	huudekom.bazar
1310	exwyided.bazar
150	tyibuhed.bazar
698	ydcuwyom.bazar
1172	eheluhom.bazar
132	ehcaekem.bazar
968	owomidom.bazar
1276	ydywidyw.bazar
713	agidided.bazar
1014	agywuhom.bazar
207	lionwyed.bazar
352	agewuhyw.bazar
617	aqacidom.bazar
774	ufcawyem.bazar
1112	ufonidyw.bazar
228	iqemekyw.bazar

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1484 set thread context of 1748 1484 rundll32.exe chrome.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1484 rundll32.exe

description	pid	process	target process
PID 1484 set thread context of 1748	1484	rundll32.exe	chrome.exe

pid	process
1484	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1720 wrote to memory of 1484	1720	cmd.exe	rundll32.exe
PID 1720 wrote to memory of 1484	1720	cmd.exe	rundll32.exe
PID 1720 wrote to memory of 1484	1720	cmd.exe	rundll32.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe
PID 1484 wrote to memory of 1748	1484	rundll32.exe	chrome.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Documents.lnk
2⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" SharedFiles.dll,BasicScore
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:1748

C:\Windows\system32\rundll32.exe
rundll32 "C:\Users\Admin\AppData\Local\Temp\SharedFiles.dll",BasicScore
1⤵
PID:1376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
4ea6b0ca63e2a5fda40355eae2a033bb

SHA1
fa39fa40b3fedd89684ff904b88ac6649cf496a6

SHA256
493188d935ab576218d951b538590e17b9526841c6af37fefe347631b5a05921

SHA512
92d22aa146292c1c75b3429905f6c04e0f7c23360d3a5b82ac587a7935ddc85582b24de8be752e6b2b2cbdb0e17421a9f03f4aa03d8dc2444c3eed2e0dbc39d9

Download Submit
memory/1484-56-0x0000000000000000-mapping.dmp

Download
memory/1484-57-0x0000000001AE0000-0x0000000001B07000-memory.dmp

Filesize
156KB

Download
memory/1484-58-0x0000000180001000-0x000000018002E000-memory.dmp

Filesize
180KB

Download
memory/1720-55-0x000007FEFBB41000-0x000007FEFBB43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads