Resubmissions
01-11-2021 12:31
211101-pp5r3ahha4 1031-10-2021 09:03
211031-k1bwxacfaq 1014-10-2021 01:44
211014-b6aflafeg4 10Analysis
-
max time kernel
530s -
max time network
549s -
platform
windows11_x64 -
resource
win11 -
submitted
01-11-2021 12:31
General
-
Target
2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll
-
Size
172KB
-
MD5
2c55997f5febc79d8aec77991f178138
-
SHA1
9d6d02ba0d021b6cdbf1fb8f594ebab3214325da
-
SHA256
2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894
-
SHA512
099ad760edaf05a1b180f451c48762627bfc374c8ed2e1ff8969d18787a366495b3576cf7f3724c932d52fa34897e4ee57b7824df9c11d6f6784ec310ee40820
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll,DllRegisterServer {E2EE75D8-B359-4006-BB58-5F375D98AE32}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1736-147-0x000001E63E290000-0x000001E63E3BC000-memory.dmpFilesize
1.2MB
-
memory/4564-146-0x0000000002AB0000-0x0000000002BDC000-memory.dmpFilesize
1.2MB