bazarloader | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

417c1828d98ba4f05f7a2edb71a9105f0aebf3d554393970b96e59d4db7b4473.dll
Size

359KB
MD5

4f18fd01d6afd232553fbbf602b2a4e2
SHA1

e50a8e3bfb891dc723f5c7fc2276055102d0a097
SHA256

417c1828d98ba4f05f7a2edb71a9105f0aebf3d554393970b96e59d4db7b4473
SHA512

750493256643799b3de954298874f6df1d87bf6fd3afa259689af2ba9159374f274937490be6159650237a74778e5565e4f9d4e5e359f9e71cc1c5fd385b4dd3

Score

10^/10

bazarloader dropper loader suricata

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 3408 created 2888 3408 regsvr32.exe Explorer.EXE
suricata: ET MALWARE BazaLoader Activity (GET)
suricata: ET MALWARE BazaLoader Activity (GET)
suricata
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

description	pid	process	target process
PID 3408 created 2888	3408	regsvr32.exe	Explorer.EXE

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral10/memory/3408-118-0x00000000012D0000-0x00000000012FC000-memory.dmp	BazarLoaderVar5
behavioral10/memory/1796-119-0x00000000010D0000-0x00000000010FC000-memory.dmp	BazarLoaderVar5

Tries to connect to .bazar domain 60 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
65	bluehail.bazar
67	bluehail.bazar
42	bluehail.bazar
62	bluehail.bazar
73	whitestorm9p.bazar
92	whitestorm9p.bazar
80	blackrain15.bazar
86	reddew28c.bazar
31	blackrain15.bazar
39	reddew28c.bazar
47	whitestorm9p.bazar
96	aqsouhyw.bazar
129	blackrain15.bazar
32	blackrain15.bazar
45	whitestorm9p.bazar
97	aqsouhyw.bazar
40	bluehail.bazar
79	blackrain15.bazar
91	bluehail.bazar
53	blackrain15.bazar
71	whitestorm9p.bazar
68	bluehail.bazar
81	blackrain15.bazar
60	reddew28c.bazar
64	bluehail.bazar
89	bluehail.bazar
95	whitestorm9p.bazar
38	reddew28c.bazar
54	blackrain15.bazar
87	reddew28c.bazar
93	whitestorm9p.bazar
128	blackrain15.bazar
44	whitestorm9p.bazar
55	blackrain15.bazar
94	whitestorm9p.bazar
69	bluehail.bazar
84	reddew28c.bazar
98	aqsouhyw.bazar
30	blackrain15.bazar
88	bluehail.bazar
85	reddew28c.bazar
59	reddew28c.bazar
70	whitestorm9p.bazar
43	bluehail.bazar
46	whitestorm9p.bazar
58	reddew28c.bazar
61	reddew28c.bazar
63	bluehail.bazar
29	blackrain15.bazar
36	reddew28c.bazar
82	blackrain15.bazar
90	bluehail.bazar
56	blackrain15.bazar
66	bluehail.bazar
72	whitestorm9p.bazar
99	aqsouhyw.bazar
130	blackrain15.bazar
37	reddew28c.bazar
41	bluehail.bazar
131	blackrain15.bazar

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 3408 set thread context of 492 3408 regsvr32.exe chrome.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3408 regsvr32.exe
3408 regsvr32.exe

description	pid	process	target process
PID 3408 set thread context of 492	3408	regsvr32.exe	chrome.exe

pid	process
3408	regsvr32.exe
3408	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe
PID 3408 wrote to memory of 492	3408	regsvr32.exe	chrome.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\417c1828d98ba4f05f7a2edb71a9105f0aebf3d554393970b96e59d4db7b4473.dll
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3408

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:492

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\417c1828d98ba4f05f7a2edb71a9105f0aebf3d554393970b96e59d4db7b4473.dll"
1⤵
PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-119-0x00000000010D0000-0x00000000010FC000-memory.dmp

Filesize
176KB

Download
memory/3408-118-0x00000000012D0000-0x00000000012FC000-memory.dmp

Filesize
176KB

Download