bazarloader | fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68 | Triage

Analysis

max time kernel
178s
max time network
201s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-05-2022 22:43

Sharing

Report Analysis Logs

General

Target

fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68.exe
Size

250KB
MD5

b8dd3183755b57f5e18f29a0430b481e
SHA1

42485407433474d4fd2b6880eef4b49fa6c277d9
SHA256

fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68
SHA512

8362fa5a3c3563b470ba06b49cfb662b7e114d77481bf656af3a1e71666ef26ad8d758776f075fe9c0634456f5c0b4a360016a75a3967b766cde8ab0449f5d31

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Tries to connect to .bazar domain 1 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

description flow ioc

HTTP URL 9 https://62.108.35.194/api/v97

C:\Users\Admin\AppData\Local\Temp\fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68.exe
"C:\Users\Admin\AppData\Local\Temp\fd47e20c094a1e23079eee41440b971162c1df668315b5e882c12805b9ec0c68.exe"
1⤵
PID:1524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-54-0x0000000000230000-0x000000000025D000-memory.dmp

Filesize
180KB

Download
memory/1524-58-0x0000000000370000-0x000000000039C000-memory.dmp

Filesize
176KB

Download
memory/1524-64-0x0000000000200000-0x000000000022B000-memory.dmp

Filesize
172KB

Download
memory/1524-65-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Filesize
8KB

Download