bazarloader | 11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1

General

Target

main.php.dll
Size

329KB
MD5

9c9b58c38841af6f89ff90a746d63cec
SHA1

95481d6dfa4660bd24ac519561269b6fbd4571c1
SHA256

11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1
SHA512

7b32798e4652f05861cdb5e03abb1eeebe4183c4f5411cc73166fc1e31dab37c00104e3cc035b2fc9c8c3300b561c17b9cffccc8af79fbc78ea2b1b1e721b518

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 952 created 1204 952 regsvr32.exe Explorer.EXE

description	pid	process	target process
PID 952 created 1204	952	regsvr32.exe	Explorer.EXE

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/952-55-0x0000000001F20000-0x0000000002130000-memory.dmp	BazarLoaderVar5
behavioral1/memory/1760-57-0x0000000001F50000-0x0000000002160000-memory.dmp	BazarLoaderVar5

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
51	bluehail.bazar
117	ehcaekem.bazar
133	ehcaekem.bazar
153	tyibuhed.bazar
121	ehcaekem.bazar
130	ehcaekem.bazar
149	tyibuhed.bazar
220	iqemekyw.bazar
134	ehcaekem.bazar
158	tuedwyyw.bazar
87	ypomuhem.bazar
96	ucwyuhyw.bazar
39	whitestorm9p.bazar
128	ehcaekem.bazar
144	tyibuhed.bazar
207	lionwyed.bazar
221	iqemekyw.bazar
156	tyibuhed.bazar
177	tuedwyyw.bazar
179	fuqeidem.bazar
193	fuqeidem.bazar
63	whitestorm9p.bazar
76	agekidem.bazar
101	ucwyuhyw.bazar
140	tyibuhed.bazar
162	tuedwyyw.bazar
183	fuqeidem.bazar
125	ehcaekem.bazar
199	lionwyed.bazar
216	lionwyed.bazar
219	lionwyed.bazar
64	aqsouhyw.bazar
164	tuedwyyw.bazar
176	tuedwyyw.bazar
186	fuqeidem.bazar
91	izididyw.bazar
94	ucwyuhyw.bazar
129	ehcaekem.bazar
154	tyibuhed.bazar
38	bluehail.bazar
81	vuewwyed.bazar
97	ucwyuhyw.bazar
147	tyibuhed.bazar
152	tyibuhed.bazar
50	reddew28c.bazar
104	ucwyuhyw.bazar
172	tuedwyyw.bazar
205	lionwyed.bazar
223	iqemekyw.bazar
106	ucwyuhyw.bazar
112	ucwyuhyw.bazar
136	tyibuhed.bazar
143	tyibuhed.bazar
202	lionwyed.bazar
224	iqemekyw.bazar
73	ydelwyyw.bazar
103	ucwyuhyw.bazar
182	fuqeidem.bazar
201	lionwyed.bazar
214	lionwyed.bazar
218	lionwyed.bazar
84	hutoekyw.bazar
135	ehcaekem.bazar
148	tyibuhed.bazar

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 952 set thread context of 1400 952 regsvr32.exe chrome.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

952 regsvr32.exe

description	pid	process	target process
PID 952 set thread context of 1400	952	regsvr32.exe	chrome.exe

pid	process
952	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe
PID 952 wrote to memory of 1400	952	regsvr32.exe	chrome.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s C:\Users\Admin\AppData\Local\Temp\main.php.dll
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1400

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\main.php.dll"
1⤵
PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5
ab5c36d10261c173c5896f3478cdc6b7

SHA1
87ac53810ad125663519e944bc87ded3979cbee4

SHA256
f8e90fb0557fe49d7702cfb506312ac0b24c97802f9c782696db6d47f434e8e9

SHA512
e83e4eae44e7a9cbcd267dbfc25a7f4f68b50591e3bbe267324b1f813c9220d565b284994ded5f7d2d371d50e1ebfa647176ec8de9716f754c6b5785c6e897fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
7b4e235ff1f4d32fa56900fe369fdee0

SHA1
466a0a322c93f5fe5733193b64355bfdc0885bb3

SHA256
245832e350896e71dfb6658a45d957c078f0bf8e9258aff38e2e6cd7074c6c21

SHA512
5e394b38d940c1b6deaadc9aed5cdca7186b05467f88183ad23aabf87a16f86f7db54d15d46f6f22527ad8ae7b1474fd3b49998d14b60d9ad40fe38493f70e44

Download Submit
memory/952-54-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

Filesize
8KB

Download
memory/952-55-0x0000000001F20000-0x0000000002130000-memory.dmp

Filesize
2.1MB

Download
memory/1760-57-0x0000000001F50000-0x0000000002160000-memory.dmp

Filesize
2.1MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads