Overview

overview

10

Static

static

main.php.dll

windows7_x64

10

main.php.dll

windows10_x64

10

Resubmissions

31-10-2021 06:34

211031-hbtpbaffb7 10

29-10-2021 13:36

211029-qwckjaabcq 10

Analysis

  • max time kernel
    136s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    29-10-2021 13:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    main.php.dll

  • Size

    329KB

  • MD5

    9c9b58c38841af6f89ff90a746d63cec

  • SHA1

    95481d6dfa4660bd24ac519561269b6fbd4571c1

  • SHA256

    11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1

  • SHA512

    7b32798e4652f05861cdb5e03abb1eeebe4183c4f5411cc73166fc1e31dab37c00104e3cc035b2fc9c8c3300b561c17b9cffccc8af79fbc78ea2b1b1e721b518

Score
10/10
bazarloaderdropperloadersuricata

Malware Config

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • suricata: ET MALWARE BazaLoader Activity (GET)

    suricata: ET MALWARE BazaLoader Activity (GET)

    suricata
  • Bazar/Team9 Loader payload 1 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\main.php.dll
    1⤵
      PID:1792

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1792-54-0x000007FEFB541000-0x000007FEFB543000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1792-55-0x0000000001DC0000-0x0000000001FD0000-memory.dmp

      Filesize

      2.1MB

      Download