bazarloader | c6c49487b97174cf00ebc3a28b15e27f9c8cfbb57294cb588e67603322581ea8

General

Target

SharedFiles.dll
Size

601KB
MD5

adf5dc4ac48443f7042237921620a740
SHA1

492528054a7de48cfab7ca982bfd7a5459b3e062
SHA256

b60a22be0a21e0a4c52a0fe0fecc2b55205297e1ddafd2364f75b46b8deedb74
SHA512

ae629b9181b773a00d6ac74dc2b262fe87995c8f5ae58ae3c3a7b2d7784b99dc382ef41fa02ff35bbdfea76aac638fa7a43b6fc00ea6fdc5b66a1bcca60568ba

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 944 created 1300 944 rundll32.exe Explorer.EXE

description	pid	process	target process
PID 944 created 1300	944	rundll32.exe	Explorer.EXE

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/944-56-0x0000000180001000-0x000000018002E000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

4 944 rundll32.exe
6 944 rundll32.exe
7 944 rundll32.exe

flow	pid	process
4	944	rundll32.exe
6	944	rundll32.exe
7	944	rundll32.exe

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
1159	tyuhuhyw.bazar
432	izywwyed.bazar
731	vuywuhem.bazar
1086	izeduhem.bazar
1112	ufonidyw.bazar
1151	tyuhuhyw.bazar
530	ehonuhyw.bazar
997	ydidekem.bazar
1000	ydidekem.bazar
1009	agywuhom.bazar
471	uccaeked.bazar
474	uccaeked.bazar
755	ypwyuhed.bazar
805	etedwyed.bazar
238	iqemekyw.bazar
595	aqacidom.bazar
814	tyqeekem.bazar
1260	iqcuuhem.bazar
285	owacidyw.bazar
311	bielwyem.bazar
575	tusouhed.bazar
616	iqelwyed.bazar
841	ehemeked.bazar
1104	etqeekom.bazar
1069	vuibekyw.bazar
1155	tyuhuhyw.bazar
1357	vueduhed.bazar
98	ucwyuhyw.bazar
173	tuedwyyw.bazar
793	izibidom.bazar
869	tysoidem.bazar
1056	ypcawyom.bazar
1342	agibekem.bazar
137	tyibuhed.bazar
189	fuqeidem.bazar
263	aquheked.bazar
514	tuqeided.bazar
617	iqelwyed.bazar
837	uconuhom.bazar
1319	hucauhyw.bazar
1321	hucauhyw.bazar
197	fuqeidem.bazar
279	aquheked.bazar
322	ydekided.bazar
370	huomuhed.bazar
423	izywwyed.bazar
428	izywwyed.bazar
790	izibidom.bazar
1349	vueduhed.bazar
1370	izqewyyw.bazar
435	ypudekyw.bazar
629	biekekyw.bazar
796	etedwyed.bazar
938	biewuhed.bazar
1283	ydywidyw.bazar
978	bicuwyed.bazar
35	reddew28c.bazar
134	tyibuhed.bazar
320	ydekided.bazar
546	liemekom.bazar
922	iqekekom.bazar
808	etedwyed.bazar
910	lieluhem.bazar
172	tuedwyyw.bazar

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 944 set thread context of 1060 944 rundll32.exe chrome.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

944 rundll32.exe

description	pid	process	target process
PID 944 set thread context of 1060	944	rundll32.exe	chrome.exe

pid	process
944	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe
PID 944 wrote to memory of 1060	944	rundll32.exe	chrome.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1300

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SharedFiles.dll,#1
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
2⤵
PID:852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:1060

C:\Windows\system32\rundll32.exe
rundll32 "C:\Users\Admin\AppData\Local\Temp\SharedFiles.dll",#1
1⤵
PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
01d5c864e4185d3eb77d71e9976f8813

SHA1
e160d3691f26a2b37115965c3c718f022029f57b

SHA256
2d82a405ee8379347b855b5a6e2bc0ba637b05701a934b28d53afe7c4451e813

SHA512
09a09f647dfb09d302e579df7e0bbe766993fb0a7a59b60c238cafc67bbd6a9e9f37a65630a14715175cd5a495eeda409946deedc208b4e98f1620bfae1db3dd

Download Submit
memory/852-57-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download
memory/944-55-0x0000000001C90000-0x0000000001CB7000-memory.dmp

Filesize
156KB

Download
memory/944-56-0x0000000180001000-0x000000018002E000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads