bazarloader | 9f433ac837309fecdd3ea85574d49350aa304d383560bb4f80654d18f64151d3

General

Target

70f35da61529c48234793cd0eeb25715ead9c3d8.dll
Size

601KB
MD5

398bc67b1475d56dccb8b48f53f1e467
SHA1

70f35da61529c48234793cd0eeb25715ead9c3d8
SHA256

9f433ac837309fecdd3ea85574d49350aa304d383560bb4f80654d18f64151d3
SHA512

6468ff6775e730d392087ec730920f8d097afa5a2400f513c4a68d5190ca15c15dd78503047478408a3de01d3b4d3186d1c7da2ea70c043d85ca76032a39ee63

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3476 created 3028 3476 rundll32.exe Explorer.EXE

description	pid	process	target process
PID 3476 created 3028	3476	rundll32.exe	Explorer.EXE

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3476-115-0x0000000180001000-0x000000018002E000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

24 3476 rundll32.exe
25 3476 rundll32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3476 set thread context of 1064 3476 rundll32.exe chrome.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3476 rundll32.exe
3476 rundll32.exe

flow	pid	process
24	3476	rundll32.exe
25	3476	rundll32.exe

description	pid	process	target process
PID 3476 set thread context of 1064	3476	rundll32.exe	chrome.exe

pid	process
3476	rundll32.exe
3476	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe
PID 3476 wrote to memory of 1064	3476	rundll32.exe	chrome.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3028

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70f35da61529c48234793cd0eeb25715ead9c3d8.dll,#1
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3476-115-0x0000000180001000-0x000000018002E000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads