Malware Analysis Report

2025-04-13 11:50

Sample ID 220119-tyrc9abeaj
Target 113fa9ae34480ab1f6b091d8928b9716a4e7dffeb3c9c47129ed249af762b47a
SHA256 113fa9ae34480ab1f6b091d8928b9716a4e7dffeb3c9c47129ed249af762b47a
Tags
bazarloader dropper loader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

113fa9ae34480ab1f6b091d8928b9716a4e7dffeb3c9c47129ed249af762b47a

Threat Level: Known bad

The file 113fa9ae34480ab1f6b091d8928b9716a4e7dffeb3c9c47129ed249af762b47a was found to be: Known bad.

Malicious Activity Summary

bazarloader dropper loader

Bazar Loader

Process spawned unexpected child process

Bazar/Team9 Loader payload

Blocklisted process makes network request

Loads dropped DLL

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-19 16:28

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-19 16:28

Reported

2022-01-19 16:30

Platform

win10v2004-en-20220112

Max time kernel

143s

Max time network

152s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\113fa9ae34480ab1f6b091d8928b9716a4e7dffeb3c9c47129ed249af762b47a.xll"

Signatures

Bazar Loader

loader dropper bazarloader

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\SYSTEM32\rundll32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

Bazar/Team9 Loader payload

Description Indicator Process Target
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A
N/A N/A C:\Windows\SYSTEM32\rundll32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3220 wrote to memory of 3552 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\SYSTEM32\rundll32.exe
PID 3220 wrote to memory of 3552 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\SYSTEM32\rundll32.exe

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\113fa9ae34480ab1f6b091d8928b9716a4e7dffeb3c9c47129ed249af762b47a.xll"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p

C:\Windows\SYSTEM32\rundll32.exe

rundll32 C:\Users\Admin\JavaObjectReflectD.dll , dopt

Network

Country Destination Domain Proto
N/A 127.0.0.1:5985 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
UA 91.201.202.219:443 tcp
NL 194.147.115.132:443 tcp

Files

memory/3220-133-0x00007FFA39A30000-0x00007FFA39A40000-memory.dmp

memory/3220-134-0x00007FFA39A30000-0x00007FFA39A40000-memory.dmp

memory/3220-135-0x00007FFA39A30000-0x00007FFA39A40000-memory.dmp

memory/3220-136-0x00007FFA39A30000-0x00007FFA39A40000-memory.dmp

memory/3220-137-0x00007FFA39A30000-0x00007FFA39A40000-memory.dmp

memory/3220-140-0x00007FFA37100000-0x00007FFA37110000-memory.dmp

memory/3220-141-0x00007FFA37100000-0x00007FFA37110000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\113fa9ae34480ab1f6b091d8928b9716a4e7dffeb3c9c47129ed249af762b47a.xll

MD5 b47c88fd74a78d1125de7b06893861c0
SHA1 6751d6a7b3e9b274a7b91c5ace5e0300eb5b7fe7
SHA256 113fa9ae34480ab1f6b091d8928b9716a4e7dffeb3c9c47129ed249af762b47a
SHA512 198d1ea049a7b929a409f3d6f33312233016fdee3e4a964dc48cd613fbd2c8eb4a5b9bc1a29d2f2eb178a4c7be023c70b108c10ef39857e8980e42e248b757dc

C:\Users\Admin\AppData\Local\Temp\113fa9ae34480ab1f6b091d8928b9716a4e7dffeb3c9c47129ed249af762b47a.xll

MD5 b47c88fd74a78d1125de7b06893861c0
SHA1 6751d6a7b3e9b274a7b91c5ace5e0300eb5b7fe7
SHA256 113fa9ae34480ab1f6b091d8928b9716a4e7dffeb3c9c47129ed249af762b47a
SHA512 198d1ea049a7b929a409f3d6f33312233016fdee3e4a964dc48cd613fbd2c8eb4a5b9bc1a29d2f2eb178a4c7be023c70b108c10ef39857e8980e42e248b757dc

C:\Users\Admin\JavaObjectReflectD.dll

MD5 0e62dec9b5f1b9d1e90648501786cc7f
SHA1 d901969acf8ed0ddcb9555059b758fb30faf18a4
SHA256 97a20d673751dfe8c9a34bc59071ee42e6c309b750ce081603e2452886102d72
SHA512 8015b72a27c6967cad475871ee8ab4a89829aa821776dfb8097034f05acaffd7be5d4f8a28445ad7cc9efdb4eae6e23d074cf068f54768db309953252623c5b0

C:\Users\Admin\JavaObjectReflectD.dll

MD5 0e62dec9b5f1b9d1e90648501786cc7f
SHA1 d901969acf8ed0ddcb9555059b758fb30faf18a4
SHA256 97a20d673751dfe8c9a34bc59071ee42e6c309b750ce081603e2452886102d72
SHA512 8015b72a27c6967cad475871ee8ab4a89829aa821776dfb8097034f05acaffd7be5d4f8a28445ad7cc9efdb4eae6e23d074cf068f54768db309953252623c5b0

memory/3552-157-0x0000000180000000-0x000000018003C000-memory.dmp

memory/3220-177-0x00007FFA39A30000-0x00007FFA39A40000-memory.dmp

memory/3220-178-0x00007FFA39A30000-0x00007FFA39A40000-memory.dmp

memory/3220-179-0x00007FFA39A30000-0x00007FFA39A40000-memory.dmp

memory/3220-180-0x00007FFA39A30000-0x00007FFA39A40000-memory.dmp