bazarloader | ac86db6b97472143b719d365b44e59391f47ae825d6f486a01789eeed0ec3725 | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220331-en
submitted
11-04-2022 02:47

Sharing

Report Analysis Logs

General

Target

9316151281933378940113971c5537a5bb8f95db2ebfb9ffefad3dbdecb3fdde.dll
Size

711KB
MD5

58a05ac00c48837f62ba94a700106f0f
SHA1

5e0b655b35ac7a997df7c6c885daa9099d4058a6
SHA256

9316151281933378940113971c5537a5bb8f95db2ebfb9ffefad3dbdecb3fdde
SHA512

faddfea12218981589c5965488e278358efc31463a98df4daa2fb4b7d9ae369401079310831f5fea794fe261310954186c354ca05fedab9161895e1510561544

Score

10^/10

bazarloader dropper loader

Malware Config

Extracted

Family

bazarloader

C2

reddew28c.bazar

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1028-54-0x0000000000120000-0x000000000014B000-memory.dmp	BazarLoaderVar6

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9316151281933378940113971c5537a5bb8f95db2ebfb9ffefad3dbdecb3fdde.dll,#1
1⤵
PID:1028

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-54-0x0000000000120000-0x000000000014B000-memory.dmp

Filesize
172KB

Download