Malware Analysis Report

2025-04-13 11:50

Sample ID 220119-lmmxpaggdn
Target 2741d6da882c151334cb7777b2f8bf26f8b0e197d244f1aa86570b040f334a76
SHA256 2741d6da882c151334cb7777b2f8bf26f8b0e197d244f1aa86570b040f334a76
Tags
bazarloader dropper loader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2741d6da882c151334cb7777b2f8bf26f8b0e197d244f1aa86570b040f334a76

Threat Level: Known bad

The file 2741d6da882c151334cb7777b2f8bf26f8b0e197d244f1aa86570b040f334a76 was found to be: Known bad.

Malicious Activity Summary

bazarloader dropper loader

Bazar Loader

Process spawned unexpected child process

Bazar/Team9 Loader payload

Blocklisted process makes network request

Loads dropped DLL

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-19 09:39

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-19 09:39

Reported

2022-01-19 09:41

Platform

win10v2004-en-20220112

Max time kernel

109s

Max time network

134s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2741d6da882c151334cb7777b2f8bf26f8b0e197d244f1aa86570b040f334a76.xll"

Signatures

Bazar Loader

loader dropper bazarloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\SYSTEM32\rundll32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

Bazar/Team9 Loader payload

Description Indicator Process Target
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3872 wrote to memory of 2508 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\SYSTEM32\rundll32.exe
PID 3872 wrote to memory of 2508 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\SYSTEM32\rundll32.exe

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2741d6da882c151334cb7777b2f8bf26f8b0e197d244f1aa86570b040f334a76.xll"

C:\Windows\SYSTEM32\rundll32.exe

rundll32 C:\Users\Admin\JavaObjectReflectX.dll , dopt

Network

Country Destination Domain Proto
UA 91.201.202.219:443 tcp
NL 194.147.115.132:443 tcp
UA 194.38.20.30:443 194.38.20.30 tcp
RU 188.127.251.106:443 tcp

Files

memory/3872-130-0x00007FFDC2850000-0x00007FFDC2860000-memory.dmp

memory/3872-131-0x00007FFDC2850000-0x00007FFDC2860000-memory.dmp

memory/3872-132-0x00007FFDC2850000-0x00007FFDC2860000-memory.dmp

memory/3872-133-0x00007FFDC2850000-0x00007FFDC2860000-memory.dmp

memory/3872-134-0x00007FFDC2850000-0x00007FFDC2860000-memory.dmp

memory/3872-137-0x00007FFDC06F0000-0x00007FFDC0700000-memory.dmp

memory/3872-138-0x00007FFDC06F0000-0x00007FFDC0700000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2741d6da882c151334cb7777b2f8bf26f8b0e197d244f1aa86570b040f334a76.xll

MD5 7d42847bf18bc1de902661998c69991f
SHA1 55feab0ce9c6eb0558b34c801d2f290ddb570afe
SHA256 2741d6da882c151334cb7777b2f8bf26f8b0e197d244f1aa86570b040f334a76
SHA512 5ae2d47ad7d4b44b4338676a5c244ea54b9fc9e8bcdd20345de189365a13d146504e962dc57907be52dca5a0bb2b81c577c71af7df25ef00bbab902ebd5b5f36

C:\Users\Admin\AppData\Local\Temp\2741d6da882c151334cb7777b2f8bf26f8b0e197d244f1aa86570b040f334a76.xll

MD5 7d42847bf18bc1de902661998c69991f
SHA1 55feab0ce9c6eb0558b34c801d2f290ddb570afe
SHA256 2741d6da882c151334cb7777b2f8bf26f8b0e197d244f1aa86570b040f334a76
SHA512 5ae2d47ad7d4b44b4338676a5c244ea54b9fc9e8bcdd20345de189365a13d146504e962dc57907be52dca5a0bb2b81c577c71af7df25ef00bbab902ebd5b5f36

C:\Users\Admin\JavaObjectReflectX.dll

MD5 1007f143ab3ef542862f5323d3658d15
SHA1 b54eebff0d4ab2d7ed635f0a6c795edab8194bf5
SHA256 fa59c90a66e8583b54aaa0e448f09e38cd4bd155ec83af931a85205fb28ed03a
SHA512 274a7b89630c3e404d17feec7877b835c677d8d921352515ee70f28385490084c696d61c097aa304752f3449b02eae772cc1ea5b6ee90bc1ed29592b23e86210

C:\Users\Admin\JavaObjectReflectX.dll

MD5 1007f143ab3ef542862f5323d3658d15
SHA1 b54eebff0d4ab2d7ed635f0a6c795edab8194bf5
SHA256 fa59c90a66e8583b54aaa0e448f09e38cd4bd155ec83af931a85205fb28ed03a
SHA512 274a7b89630c3e404d17feec7877b835c677d8d921352515ee70f28385490084c696d61c097aa304752f3449b02eae772cc1ea5b6ee90bc1ed29592b23e86210

memory/2508-152-0x0000000180000000-0x000000018003C000-memory.dmp

memory/3872-174-0x00007FFDC2850000-0x00007FFDC2860000-memory.dmp

memory/3872-175-0x00007FFDC2850000-0x00007FFDC2860000-memory.dmp

memory/3872-176-0x00007FFDC2850000-0x00007FFDC2860000-memory.dmp

memory/3872-177-0x00007FFDC2850000-0x00007FFDC2860000-memory.dmp