Analysis
-
max time kernel
697s -
max time network
717s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
31-10-2021 06:34
Static task
static1
Behavioral task
behavioral1
Sample
main.php.dll
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
main.php.dll
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
main.php.dll
-
Size
329KB
-
MD5
9c9b58c38841af6f89ff90a746d63cec
-
SHA1
95481d6dfa4660bd24ac519561269b6fbd4571c1
-
SHA256
11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1
-
SHA512
7b32798e4652f05861cdb5e03abb1eeebe4183c4f5411cc73166fc1e31dab37c00104e3cc035b2fc9c8c3300b561c17b9cffccc8af79fbc78ea2b1b1e721b518
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 952 created 1204 952 regsvr32.exe 13 -
Bazar/Team9 Loader payload 2 IoCs
resource yara_rule behavioral1/memory/952-55-0x0000000001F20000-0x0000000002130000-memory.dmp BazarLoaderVar5 behavioral1/memory/1760-57-0x0000000001F50000-0x0000000002160000-memory.dmp BazarLoaderVar5 -
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
flow ioc 51 bluehail.bazar 117 ehcaekem.bazar 133 ehcaekem.bazar 153 tyibuhed.bazar 121 ehcaekem.bazar 130 ehcaekem.bazar 149 tyibuhed.bazar 220 iqemekyw.bazar 134 ehcaekem.bazar 158 tuedwyyw.bazar 87 ypomuhem.bazar 96 ucwyuhyw.bazar 39 whitestorm9p.bazar 128 ehcaekem.bazar 144 tyibuhed.bazar 207 lionwyed.bazar 221 iqemekyw.bazar 156 tyibuhed.bazar 177 tuedwyyw.bazar 179 fuqeidem.bazar 193 fuqeidem.bazar 63 whitestorm9p.bazar 76 agekidem.bazar 101 ucwyuhyw.bazar 140 tyibuhed.bazar 162 tuedwyyw.bazar 183 fuqeidem.bazar 125 ehcaekem.bazar 199 lionwyed.bazar 216 lionwyed.bazar 219 lionwyed.bazar 64 aqsouhyw.bazar 164 tuedwyyw.bazar 176 tuedwyyw.bazar 186 fuqeidem.bazar 91 izididyw.bazar 94 ucwyuhyw.bazar 129 ehcaekem.bazar 154 tyibuhed.bazar 38 bluehail.bazar 81 vuewwyed.bazar 97 ucwyuhyw.bazar 147 tyibuhed.bazar 152 tyibuhed.bazar 50 reddew28c.bazar 104 ucwyuhyw.bazar 172 tuedwyyw.bazar 205 lionwyed.bazar 223 iqemekyw.bazar 106 ucwyuhyw.bazar 112 ucwyuhyw.bazar 136 tyibuhed.bazar 143 tyibuhed.bazar 202 lionwyed.bazar 224 iqemekyw.bazar 73 ydelwyyw.bazar 103 ucwyuhyw.bazar 182 fuqeidem.bazar 201 lionwyed.bazar 214 lionwyed.bazar 218 lionwyed.bazar 84 hutoekyw.bazar 135 ehcaekem.bazar 148 tyibuhed.bazar -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 952 set thread context of 1400 952 regsvr32.exe 30 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 952 regsvr32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30 PID 952 wrote to memory of 1400 952 regsvr32.exe 30
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\main.php.dll2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵PID:1400
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\main.php.dll"1⤵PID:1760