Analysis
- max time kernel
159s - max time network
183s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
28/01/2022, 13:15
General
- Target SharedFiles.dll
- Size 601KB
- Sample220128-qhb2vadfc9
- SHA256 b60a22be0a21e0a4c52a0fe0fecc2b55205297e1ddafd2364f75b46b8deedb74
Score
10/10
Malware Config
Signatures
- Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
- Bazar/Team9 Loader payload 1 IoCs
- Blocklisted process makes network request 10 IoCs
- Tries to connect to .bazar domain 3 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SharedFiles.dll,#11⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1996-118-0x0000000180000000-0x000000018002E000-memory.dmp