bazarloader | 8de17cf24ee615ebefd88dfb5ec83258cb04a295f199d2f962cba788cdcaf098 | Triage™

Analysis

max time kernel
120s
max time network
129s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/01/2022, 19:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
paerax64.dll
Size 327KB
Sample220124-x53xeahehr
SHA256 8de17cf24ee615ebefd88dfb5ec83258cb04a295f199d2f962cba788cdcaf098
MD5 2b633b182a0adaa07c60c61e733ee34b
SHA1 a5c015e2ef9c5a1d929785e61e97ff425df30b87
SHA512 95e9628b1aeebdb2a7e01f87fe6aab25c56c49353be826357f6df0d50a6e652c4031f921cb5fb6bb764ec954fa87d373b0da2a58aac54b9e0219e4b183ddafab
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

resource	yara_rule
behavioral2/memory/3536-115-0x0000023770A80000-0x0000023770C4E000-memory.dmp	BazarLoaderVar6
behavioral2/memory/2096-116-0x000001DE0F390000-0x000001DE0F55E000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 2 IoCs

flow	pid	Process
30	3536	rundll32.exe
50	3536	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\paerax64.dll,#1
1⤵
- Blocklisted process makes network request
PID:3536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\paerax64.dll,#1 {D2A4C2A4-6519-4536-842C-C8522E35E864}
1⤵
PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2096-116-0x000001DE0F390000-0x000001DE0F55E000-memory.dmp

Download

memory/3536-115-0x0000023770A80000-0x0000023770C4E000-memory.dmp

Download