bazarloader | bd0b7a5e28d9fb31657ed7bfe1a4078237909cd5747ab3705a5d5aa609eab73e

General

Target

GiecQSs.bin.dll
Size

186KB
MD5

6bdc157542846873b3ea1854f4e93d76
SHA1

b14ed5008108b570ec40c3c2d8390d0efb31cef7
SHA256

fd17907d5c330897248b4eeb10b26bd72a1a9d15eb8422c80a4bf17a9eccc24d
SHA512

2ecb5c8695e927369e464634d2464e6e6e25f660453b3b6c43b035d883627a57c90ccdc5da467b4b110ff735a445332735ca9413ad0c723fb4a11cbd4d82f045

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 4144 created 2880 4144 regsvr32.exe Explorer.EXE

description	pid	process	target process
PID 4144 created 2880	4144	regsvr32.exe	Explorer.EXE

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4144-117-0x00000000001D0000-0x0000000000200000-memory.dmp	BazarLoaderVar5

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 4144 set thread context of 620 4144 regsvr32.exe chrome.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4144 regsvr32.exe
4144 regsvr32.exe

description	pid	process	target process
PID 4144 set thread context of 620	4144	regsvr32.exe	chrome.exe

pid	process
4144	regsvr32.exe
4144	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe
PID 4144 wrote to memory of 620	4144	regsvr32.exe	chrome.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2880

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\GiecQSs.bin.dll
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:620

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\GiecQSs.bin.dll"
1⤵
PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4144-115-0x00000000004D0000-0x00000000004D2000-memory.dmp

Filesize
8KB

Download
memory/4144-116-0x00000000004D0000-0x00000000004D2000-memory.dmp

Filesize
8KB

Download
memory/4144-117-0x00000000001D0000-0x0000000000200000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads