bazarloader | 7f56e7ddc6427acbd8db28b4a4fc43a73d2f090ae9a306665bde3c3339e48687 | Triage™

Analysis

max time kernel
148s
max time network
148s
platform
windows10_x64
resource
win10-en-20211208
submitted
23/01/2022, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9d74775cb5cfb43e118cfb43d71bc20.dll
Size 319KB
Sample220123-w4bk4agch9
SHA256 7f56e7ddc6427acbd8db28b4a4fc43a73d2f090ae9a306665bde3c3339e48687
MD5 c9d74775cb5cfb43e118cfb43d71bc20
SHA1 6a27938e62f9b2b42d9e6710aa3f648ddef04791
SHA512 f3d039ac8c43cae2d3aec4c7cbecfc7a8cc0ddf6c9a966537ee742e26ec624d99c8a2b56c0ef2f8af17d0667049c164b8c423816b9356e847cf7edae8458ff53
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

resource	yara_rule
behavioral2/memory/2396-115-0x0000022F58A00000-0x0000022F58BCE000-memory.dmp	BazarLoaderVar6
behavioral2/memory/1204-116-0x000001CE2FE70000-0x000001CE3003E000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 7 IoCs

flow	pid	Process
27	2396	rundll32.exe
29	2396	rundll32.exe
31	2396	rundll32.exe
33	2396	rundll32.exe
34	2396	rundll32.exe
35	2396	rundll32.exe
36	2396	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9d74775cb5cfb43e118cfb43d71bc20.dll,#1
1⤵
- Blocklisted process makes network request
PID:2396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9d74775cb5cfb43e118cfb43d71bc20.dll,#1 {D8F1FE39-83FB-43D9-8EB2-C29C8B56F716}
1⤵
PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-116-0x000001CE2FE70000-0x000001CE3003E000-memory.dmp

Download

memory/2396-115-0x0000022F58A00000-0x0000022F58BCE000-memory.dmp

Download