bazarloader | 89121a077c1de6eef1718279b77224609033daa1c6c037a4a1ceadb2c4ab2f60 | Triage™

Analysis

max time kernel
131s
max time network
149s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/01/2022, 16:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
insucar.dll
Size 324KB
Sample220124-t6n8vsffc9
SHA256 89121a077c1de6eef1718279b77224609033daa1c6c037a4a1ceadb2c4ab2f60
MD5 8b61c7c621df7f47839717d5e0db7a4f
SHA1 eeced10f9ec31511f9d68f60016a1fe27feab01b
SHA512 e8cd4dc7c6f7829b93dd13f595b64d6cf45260fc0a382ce9ed97dd3c872b7193790319e23dc208402c2b646564f97fae1f17cec6601f54e4b3a0d0429de4296a
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

resource	yara_rule
behavioral2/memory/3064-118-0x000001DCAC430000-0x000001DCAC5FE000-memory.dmp	BazarLoaderVar6
behavioral2/memory/3916-119-0x000001DDEBAE0000-0x000001DDEBCAE000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 5 IoCs

flow	pid	Process
38	3064	rundll32.exe
42	3064	rundll32.exe
44	3064	rundll32.exe
46	3064	rundll32.exe
47	3064	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\insucar.dll,#1
1⤵
- Blocklisted process makes network request
PID:3064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\insucar.dll,#1 {8AB0D38A-7FD6-43B4-9248-76E8A877D5E8}
1⤵
PID:3916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3064-118-0x000001DCAC430000-0x000001DCAC5FE000-memory.dmp

Download

memory/3916-119-0x000001DDEBAE0000-0x000001DDEBCAE000-memory.dmp

Download