bazarloader | 9f433ac837309fecdd3ea85574d49350aa304d383560bb4f80654d18f64151d3 | Triage

Analysis

max time kernel
136s
max time network
139s
platform
windows7_x64
resource
win7-en-20210920
submitted
26-10-2021 11:33

Sharing

Report Analysis Logs

General

Target

70f35da61529c48234793cd0eeb25715ead9c3d8.dll
Size

601KB
MD5

398bc67b1475d56dccb8b48f53f1e467
SHA1

70f35da61529c48234793cd0eeb25715ead9c3d8
SHA256

9f433ac837309fecdd3ea85574d49350aa304d383560bb4f80654d18f64151d3
SHA512

6468ff6775e730d392087ec730920f8d097afa5a2400f513c4a68d5190ca15c15dd78503047478408a3de01d3b4d3186d1c7da2ea70c043d85ca76032a39ee63

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1720-55-0x0000000180001000-0x000000018002E000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

4 1720 rundll32.exe
6 1720 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70f35da61529c48234793cd0eeb25715ead9c3d8.dll,#1
1⤵
- Blocklisted process makes network request
PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-54-0x00000000002A0000-0x00000000002C7000-memory.dmp

Filesize
156KB

Download
memory/1720-55-0x0000000180001000-0x000000018002E000-memory.dmp

Filesize
180KB

Download