bazarloader | d21d616f6052e8b62292fcc6d9fd9ee2a3b549c59ca76aa8ef5a96cd163512ac

Analysis

Target
youtube.dll
Size 214KB
Sample220525-2sw1jsaefr
SHA256 d21d616f6052e8b62292fcc6d9fd9ee2a3b549c59ca76aa8ef5a96cd163512ac
MD5 9a4ef0169f86641aa99017049de272f5
SHA1 82e1a3868eff88753fe30abedf7c83620aaddd13
SHA512 9b9bff3e64ee7f060679b3ff8704b8f89057748906198c674e7ebec7a51e33023af119997877790837389905090d57559eadc49811f53973b7ed91f3552c9e84
MD5 SHA1 SHA512

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
212	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 3616	2788	rundll32.exe	88
PID 2788 wrote to memory of 3616	2788	rundll32.exe	88
PID 3616 wrote to memory of 212	3616	cmd.exe	90
PID 3616 wrote to memory of 212	3616	cmd.exe	90
PID 3616 wrote to memory of 4040	3616	cmd.exe	91
PID 3616 wrote to memory of 4040	3616	cmd.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\youtube.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\system32\cmd.exe
  cmd /c timeout /t 8 /nobreak > NUL & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\youtube.dll", #1 ZF3bI6aD VI0rr2aG & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\timeout.exe
    timeout /t 8 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:212
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\youtube.dll", #1 ZF3bI6aD VI0rr2aG
    3⤵
    PID:4040

memory/2788-130-0x000002BEC43A0000-0x000002BEC43C0000-memory.dmp

Download

memory/4040-134-0x0000026B58A70000-0x0000026B58A90000-memory.dmp

Download