bazarloader | 6ded961df635c7337cfe2e9ab1e01296b9650b061ec72377ffa1310f8a95df05 | Triage™

Analysis

max time kernel
122s
max time network
152s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/01/2022, 21:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.UDS.Trojan.Win64.Kryplod.31210.dll
Size 327KB
Sample220124-1v3ensahc2
SHA256 6ded961df635c7337cfe2e9ab1e01296b9650b061ec72377ffa1310f8a95df05
MD5 fdb0fdc46ec583cb0e37a52454b649c0
SHA1 8111792a276fed384a924cd61f31d46787559de4
SHA512 1fb3c7811734a30bd932fd0ed44fc80eeba431be7fff61ad3f328ef5d723d509de3967e4101d9fb0bfd01701836bfca1e8a37f8a6022d4bfc76b48e82c317e77
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

resource	yara_rule
behavioral2/memory/2608-118-0x000001E1BC900000-0x000001E1BCACE000-memory.dmp	BazarLoaderVar6
behavioral2/memory/2576-119-0x0000019BCCEF0000-0x0000019BCD0BE000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 5 IoCs

flow	pid	Process
25	2608	rundll32.exe
43	2608	rundll32.exe
47	2608	rundll32.exe
49	2608	rundll32.exe
51	2608	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.UDS.Trojan.Win64.Kryplod.31210.dll,#1
1⤵
- Blocklisted process makes network request
PID:2608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.UDS.Trojan.Win64.Kryplod.31210.dll,#1 {10DA2F0C-40BA-4DD3-A146-15B3CEC06DA9}
1⤵
PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-119-0x0000019BCCEF0000-0x0000019BCD0BE000-memory.dmp

Download

memory/2608-118-0x000001E1BC900000-0x000001E1BCACE000-memory.dmp

Download