bazarloader | bc5b812f4681af6921012d979b6306137a142df19dca1b9c2fcd393c9b4d7f6c

General

Target

c59893a152b5eb07b5d95d26bd7d2208124c70b4.dll
Size

186KB
MD5

78de1f5c42d0446bd01c29e4707d432c
SHA1

c59893a152b5eb07b5d95d26bd7d2208124c70b4
SHA256

bc5b812f4681af6921012d979b6306137a142df19dca1b9c2fcd393c9b4d7f6c
SHA512

3d8f8f2ad7f6eefce3cc960797c32a402f08d5766b7cb45b60166a53e5d46304ddf7af4d24f42589363789fbe1178f5d2232c1e7f9c89a09c3f40f2bfbc171a8

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1604 created 1400 1604 regsvr32.exe Explorer.EXE

description	pid	process	target process
PID 1604 created 1400	1604	regsvr32.exe	Explorer.EXE

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1604-55-0x0000000001D00000-0x0000000001D30000-memory.dmp	BazarLoaderVar5
behavioral1/memory/1900-59-0x00000000001D0000-0x0000000000200000-memory.dmp	BazarLoaderVar5

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 1604 set thread context of 2044 1604 regsvr32.exe chrome.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1604 regsvr32.exe

description	pid	process	target process
PID 1604 set thread context of 2044	1604	regsvr32.exe	chrome.exe

pid	process
1604	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe
PID 1604 wrote to memory of 2044	1604	regsvr32.exe	chrome.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1400

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c59893a152b5eb07b5d95d26bd7d2208124c70b4.dll
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:2044

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\c59893a152b5eb07b5d95d26bd7d2208124c70b4.dll"
1⤵
PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
ab5c36d10261c173c5896f3478cdc6b7

SHA1
87ac53810ad125663519e944bc87ded3979cbee4

SHA256
f8e90fb0557fe49d7702cfb506312ac0b24c97802f9c782696db6d47f434e8e9

SHA512
e83e4eae44e7a9cbcd267dbfc25a7f4f68b50591e3bbe267324b1f813c9220d565b284994ded5f7d2d371d50e1ebfa647176ec8de9716f754c6b5785c6e897fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
1df00bde40b49cdaca497abfcb8fb918

SHA1
b8c27d35721a369a637c94c4f2bef3f4b0e15bfa

SHA256
5eb459cf050cc63d050a2a4fabbf76f2853dc84b3e4aab2b00c5da53c17d4f9f

SHA512
98b9ed9b66778b4d276958cee0295a6b66246e430a70b01330828cfc315092331da5de81216051f416ce45f74981e01e62dc390b7a79a1624defd0c9f3211c26

Download Submit
memory/1604-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1604-55-0x0000000001D00000-0x0000000001D30000-memory.dmp

Filesize
192KB

Download
memory/1900-59-0x00000000001D0000-0x0000000000200000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads