bazarloader | bc5b812f4681af6921012d979b6306137a142df19dca1b9c2fcd393c9b4d7f6c

General

Target

c59893a152b5eb07b5d95d26bd7d2208124c70b4.dll
Size

186KB
MD5

78de1f5c42d0446bd01c29e4707d432c
SHA1

c59893a152b5eb07b5d95d26bd7d2208124c70b4
SHA256

bc5b812f4681af6921012d979b6306137a142df19dca1b9c2fcd393c9b4d7f6c
SHA512

3d8f8f2ad7f6eefce3cc960797c32a402f08d5766b7cb45b60166a53e5d46304ddf7af4d24f42589363789fbe1178f5d2232c1e7f9c89a09c3f40f2bfbc171a8

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 2688 created 3032 2688 regsvr32.exe Explorer.EXE

description	pid	process	target process
PID 2688 created 3032	2688	regsvr32.exe	Explorer.EXE

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2688-117-0x0000000002420000-0x0000000002450000-memory.dmp	BazarLoaderVar5

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 2688 set thread context of 2152 2688 regsvr32.exe chrome.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2688 regsvr32.exe
2688 regsvr32.exe

description	pid	process	target process
PID 2688 set thread context of 2152	2688	regsvr32.exe	chrome.exe

pid	process
2688	regsvr32.exe
2688	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe
PID 2688 wrote to memory of 2152	2688	regsvr32.exe	chrome.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3032

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c59893a152b5eb07b5d95d26bd7d2208124c70b4.dll
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2688-116-0x0000000002450000-0x0000000002452000-memory.dmp

Filesize
8KB

Download
memory/2688-115-0x0000000002450000-0x0000000002452000-memory.dmp

Filesize
8KB

Download
memory/2688-117-0x0000000002420000-0x0000000002450000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads