bazarloader | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

c5d2f0da18fb33a25b53fd8b9b98f0bfa95458e3c0feb687852f469167a0110c.dll
Size

359KB
MD5

b2c85051f93825721307c34cd0f0cb34
SHA1

ca3a01d833dafaef66c2614dc3039f9c2a376229
SHA256

c5d2f0da18fb33a25b53fd8b9b98f0bfa95458e3c0feb687852f469167a0110c
SHA512

490a972e0bcbb88011829e0834c2f2dc163c91d9f078755413dd88eb48580f8adb37b7fdc20264f2e642c58e07ff2f7503f47ec05c152839d31954b22e869377

Score

10^/10

bazarloader dropper loader suricata

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 3768 created 2808 3768 regsvr32.exe Explorer.EXE
suricata: ET MALWARE BazaLoader Activity (GET)
suricata: ET MALWARE BazaLoader Activity (GET)
suricata
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

description	pid	process	target process
PID 3768 created 2808	3768	regsvr32.exe	Explorer.EXE

Bazar/Team9 Loader payload 3 IoCs

Processes:

resource	yara_rule
behavioral28/memory/3768-118-0x0000000000BA0000-0x0000000000BCC000-memory.dmp	BazarLoaderVar5
behavioral28/memory/1432-119-0x0000000000CF0000-0x0000000000D1C000-memory.dmp	BazarLoaderVar5
behavioral28/memory/1900-120-0x00000000001C0000-0x00000000001EC000-memory.dmp	BazarLoaderVar5

Tries to connect to .bazar domain 56 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

flow	ioc
39	bluehail.bazar
66	whitestorm9p.bazar
44	whitestorm9p.bazar
51	blackrain15.bazar
83	bluehail.bazar
90	aqsouhyw.bazar
121	blackrain15.bazar
119	blackrain15.bazar
41	bluehail.bazar
54	blackrain15.bazar
57	reddew28c.bazar
85	bluehail.bazar
93	aqsouhyw.bazar
118	blackrain15.bazar
29	blackrain15.bazar
32	blackrain15.bazar
37	reddew28c.bazar
42	whitestorm9p.bazar
62	bluehail.bazar
76	blackrain15.bazar
89	whitestorm9p.bazar
31	blackrain15.bazar
45	whitestorm9p.bazar
56	reddew28c.bazar
60	bluehail.bazar
61	bluehail.bazar
82	bluehail.bazar
30	blackrain15.bazar
59	reddew28c.bazar
63	bluehail.bazar
86	whitestorm9p.bazar
91	aqsouhyw.bazar
34	reddew28c.bazar
78	reddew28c.bazar
43	whitestorm9p.bazar
73	blackrain15.bazar
74	blackrain15.bazar
84	bluehail.bazar
36	reddew28c.bazar
67	whitestorm9p.bazar
120	blackrain15.bazar
38	bluehail.bazar
53	blackrain15.bazar
79	reddew28c.bazar
81	reddew28c.bazar
88	whitestorm9p.bazar
64	whitestorm9p.bazar
92	aqsouhyw.bazar
52	blackrain15.bazar
35	reddew28c.bazar
75	blackrain15.bazar
87	whitestorm9p.bazar
80	reddew28c.bazar
40	bluehail.bazar
58	reddew28c.bazar
65	whitestorm9p.bazar

Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 3768 set thread context of 3816 3768 regsvr32.exe chrome.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3768 regsvr32.exe
3768 regsvr32.exe

description	pid	process	target process
PID 3768 set thread context of 3816	3768	regsvr32.exe	chrome.exe

pid	process
3768	regsvr32.exe
3768	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe
PID 3768 wrote to memory of 3816	3768	regsvr32.exe	chrome.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2808

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c5d2f0da18fb33a25b53fd8b9b98f0bfa95458e3c0feb687852f469167a0110c.dll
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:3816

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\c5d2f0da18fb33a25b53fd8b9b98f0bfa95458e3c0feb687852f469167a0110c.dll"
1⤵
PID:1432

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\c5d2f0da18fb33a25b53fd8b9b98f0bfa95458e3c0feb687852f469167a0110c.dll"
1⤵
PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1432-119-0x0000000000CF0000-0x0000000000D1C000-memory.dmp

Filesize
176KB

Download
memory/1900-120-0x00000000001C0000-0x00000000001EC000-memory.dmp

Filesize
176KB

Download
memory/3768-118-0x0000000000BA0000-0x0000000000BCC000-memory.dmp

Filesize
176KB

Download