bazarloader | a8f0170ad5e5cdb0533ea888b0dbc97bc4bd23c9a0531e5e4b7cd1f05fa0875d | Triage

Resubmissions

28-03-2022 12:32

220328-pqyedaeaej 10

18-01-2022 06:25

220118-g64mbsabcm 10

05-05-2021 04:52

210505-vc9dqnmbba 10

Analysis

max time kernel
4294212s
max time network
145s
platform
windows7_x64
resource
win7-20220310-en
submitted
28-03-2022 12:32

Sharing

Report Analysis Logs

General

Target

krerb.exe
Size

199KB
MD5

1c74d51a1d7177bf9b23f6a567adc047
SHA1

ecb47205a047b173c4ecaf4f476204ef7154a7ad
SHA256

a8f0170ad5e5cdb0533ea888b0dbc97bc4bd23c9a0531e5e4b7cd1f05fa0875d
SHA512

0f2320ab1c60536cad706564a4ea739f2bac1b7cdd538ac1672542c9c02563292d95c2789845629ce696eca356876859a3efd57b305432d4d833fffd1b4cbef4

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/780-54-0x00000000001D0000-0x00000000001F7000-memory.dmp	BazarLoaderVar6

C:\Users\Admin\AppData\Local\Temp\krerb.exe
"C:\Users\Admin\AppData\Local\Temp\krerb.exe"
1⤵
PID:780

C:\Users\Admin\AppData\Local\Temp\krerb.exe
C:\Users\Admin\AppData\Local\Temp\krerb.exe {0EA22136-560D-4F82-B6CC-04B4067B3BCD}
1⤵
PID:1136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-54-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/780-60-0x000007FEFC291000-0x000007FEFC293000-memory.dmp

Filesize
8KB

Download