bazarloader | 9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33 | Triage

Analysis

max time kernel
111s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
10-05-2022 17:48

Sharing

Report Analysis Logs

General

Target

9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33.exe
Size

156KB
MD5

76b0f0d39f02744dd1937fe7688807d8
SHA1

64cfa7352be82723e11282099975635f33fe7eb5
SHA256

9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33
SHA512

b2eca7e0282f91180ab5f351e8e7eb74bea787976cadfd7e41b5b88147addef9d15cadd1a03070fa83cb18af05e17cc695d7ed3a193c665b217bd91077d04503

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Tries to connect to .bazar domain 1 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

Processes:

description flow ioc

HTTP URL 40 https://62.108.35.194/api/v129

C:\Users\Admin\AppData\Local\Temp\9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33.exe
"C:\Users\Admin\AppData\Local\Temp\9368b2e452b648df6375818ef333bef1810b36e83db0a950515dcbb7ab34ff33.exe"
1⤵
PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...