bazarloader | c6c49487b97174cf00ebc3a28b15e27f9c8cfbb57294cb588e67603322581ea8

General

Target

SharedFiles.dll
Size

601KB
MD5

adf5dc4ac48443f7042237921620a740
SHA1

492528054a7de48cfab7ca982bfd7a5459b3e062
SHA256

b60a22be0a21e0a4c52a0fe0fecc2b55205297e1ddafd2364f75b46b8deedb74
SHA512

ae629b9181b773a00d6ac74dc2b262fe87995c8f5ae58ae3c3a7b2d7784b99dc382ef41fa02ff35bbdfea76aac638fa7a43b6fc00ea6fdc5b66a1bcca60568ba

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 4092 created 2712 4092 rundll32.exe Explorer.EXE

description	pid	process	target process
PID 4092 created 2712	4092	rundll32.exe	Explorer.EXE

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral4/memory/4092-115-0x0000000180001000-0x000000018002E000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

23 4092 rundll32.exe
24 4092 rundll32.exe

flow	pid	process
23	4092	rundll32.exe
24	4092	rundll32.exe

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
823	uconuhom.bazar
447	ypudekyw.bazar
525	tuqeided.bazar
569	tusouhed.bazar
728	huudekom.bazar
1211	iqcuuhem.bazar
1319	izqewyyw.bazar
154	tyibuhed.bazar
319	bielwyem.bazar
894	lieluhem.bazar
1041	vuibekyw.bazar
232	iqemekyw.bazar
338	ydekided.bazar
392	huomuhed.bazar
151	tyibuhed.bazar
575	tusouhed.bazar
989	agywuhom.bazar
1029	ypcawyom.bazar
1035	vuibekyw.bazar
1091	ucemwyem.bazar
204	fuqeidem.bazar
294	owacidyw.bazar
423	vuididom.bazar
492	etibidyw.bazar
1151	eheluhom.bazar
1082	ufonidyw.bazar
1116	etsoidom.bazar
137	ehcaekem.bazar
178	tuedwyyw.bazar
284	aquheked.bazar
407	agcuwyyw.bazar
396	agcuwyyw.bazar
465	ufwyuhom.bazar
972	ydidekem.bazar
643	ydewuhom.bazar
801	tyqeekem.bazar
181	tuedwyyw.bazar
395	agcuwyyw.bazar
537	ehonuhyw.bazar
907	iqekekom.bazar
152	tyibuhed.bazar
281	aquheked.bazar
1097	ucemwyem.bazar
364	extoekom.bazar
421	vuididom.bazar
905	iqekekom.bazar
939	owomidom.bazar
1108	etsoidom.bazar
1337	yponidem.bazar
176	tuedwyyw.bazar
222	lionwyed.bazar
851	tysoidem.bazar
997	exudwyyw.bazar
256	fusouhem.bazar
418	vuididom.bazar
471	ufwyuhom.bazar
932	aqtowyem.bazar
1019	huwyidem.bazar
1217	iqcuuhem.bazar
292	owacidyw.bazar
425	vuididom.bazar
441	izywwyed.bazar
452	ypudekyw.bazar
231	iqemekyw.bazar

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 4092 set thread context of 1060 4092 rundll32.exe chrome.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4092 rundll32.exe
4092 rundll32.exe

description	pid	process	target process
PID 4092 set thread context of 1060	4092	rundll32.exe	chrome.exe

pid	process
4092	rundll32.exe
4092	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe
PID 4092 wrote to memory of 1060	4092	rundll32.exe	chrome.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SharedFiles.dll,#1
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:1060

C:\Windows\system32\rundll32.exe
rundll32 "C:\Users\Admin\AppData\Local\Temp\SharedFiles.dll",#1
1⤵
PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4092-115-0x0000000180001000-0x000000018002E000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads