bazarloader | 1b081afae6c33f87452aac5f1ded863f0229d13ff4b36e67c1d65d3c2d18de6d | Triage

Analysis

max time kernel
121s
max time network
136s
platform
windows10_x64
resource
win10-en-20210920
submitted
25-10-2021 18:10

Sharing

Report Analysis Logs

General

Target

LtVlkJg.bin.dll
Size

186KB
MD5

e7836b449e9d7ab89817c7f54d5b1700
SHA1

bae8e214ea4080381a8eea88320726a074d120c1
SHA256

1b081afae6c33f87452aac5f1ded863f0229d13ff4b36e67c1d65d3c2d18de6d
SHA512

4084af9c795f720803ba35504b4f9a7884e089deb8ad382479f484dc8677898625f8bd009ac1f31fa96e0459f723d6cea1436f4125beb3071afa0a43ca3b3e53

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3040-117-0x0000000002760000-0x0000000002790000-memory.dmp	BazarLoaderVar5

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\LtVlkJg.bin.dll
1⤵
PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-116-0x0000000002790000-0x0000000002792000-memory.dmp

Filesize
8KB

Download
memory/3040-115-0x0000000002790000-0x0000000002792000-memory.dmp

Filesize
8KB

Download
memory/3040-117-0x0000000002760000-0x0000000002790000-memory.dmp

Filesize
192KB

Download