Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    02/12/2021, 12:07

General

  • Target

    bb62610dd76178bbcf45eb21d8f644977c23d0391f5f3d89b406b2caca619d2a.dll

  • Size

    393KB

  • MD5

    eb2338c71a210835401162d1e1ed9174

  • SHA1

    7451b3eeb0efad68d4c4347267369847b169bf9c

  • SHA256

    bb62610dd76178bbcf45eb21d8f644977c23d0391f5f3d89b406b2caca619d2a

  • SHA512

    325925ce022a08fd0df481eb0b9427188743c02edd4739ad935a9b8b6dd1e0453b02f37453c09cdde6ee8fdf70c1219c32228e341cdf9b4a2130b9bfc0ee9ade

Malware Config

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

  • Bazar/Team9 Loader payload 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bb62610dd76178bbcf45eb21d8f644977c23d0391f5f3d89b406b2caca619d2a.dll
    1⤵
      PID:1592
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb62610dd76178bbcf45eb21d8f644977c23d0391f5f3d89b406b2caca619d2a.dll,DllRegisterServer {1ACB10D1-5CA9-43B8-BE0B-5D186CD5CAC1}
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:560
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 560 -s 92
        2⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:1492

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1492-59-0x0000000001D60000-0x0000000001D61000-memory.dmp

            Filesize

            4KB

          • memory/1592-55-0x000007FEFB6F1000-0x000007FEFB6F3000-memory.dmp

            Filesize

            8KB

          • memory/1592-56-0x00000000002D0000-0x00000000002E7000-memory.dmp

            Filesize

            92KB