bazarloader | 35c965adf28e7f42c45a70778e12dd69d9a07756a391d4ab43e69b69cf688e70 | Triage™

Analysis

max time kernel
151s
max time network
157s
platform
windows7_x64
resource
win7-en-20211208
submitted
28/01/2022, 13:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SharedFiles.dll
Size 601KB
Sample220128-qhb2vadfc9
SHA256 b60a22be0a21e0a4c52a0fe0fecc2b55205297e1ddafd2364f75b46b8deedb74
MD5 adf5dc4ac48443f7042237921620a740
SHA1 492528054a7de48cfab7ca982bfd7a5459b3e062
SHA512 ae629b9181b773a00d6ac74dc2b262fe87995c8f5ae58ae3c3a7b2d7784b99dc382ef41fa02ff35bbdfea76aac638fa7a43b6fc00ea6fdc5b66a1bcca60568ba
MD5 SHA1 SHA512

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 1 IoCs

resource	yara_rule
behavioral3/memory/964-55-0x0000000180000000-0x000000018002E000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 6 IoCs

flow	pid	Process
4	964	rundll32.exe
5	964	rundll32.exe
6	964	rundll32.exe
7	964	rundll32.exe
10	964	rundll32.exe
11	964	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SharedFiles.dll,#1
1⤵
- Blocklisted process makes network request
PID:964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-54-0x0000000000190000-0x00000000001B7000-memory.dmp

Download

memory/964-55-0x0000000180000000-0x000000018002E000-memory.dmp

Download