bazarloader | b51cb6fa584a073fe95bcf8749cf84363cb431f520a5d97cec92aae88329b7cb

Analysis

Target

fileman.dll
Size

213KB
MD5

6f3be0dfe6b5971b16464b7924772445
SHA1

8af5e975c00f5bdbd843f644a60adbb5f8da8a0d
SHA256

b51cb6fa584a073fe95bcf8749cf84363cb431f520a5d97cec92aae88329b7cb
SHA512

a1a8d49ec7610c37284a2e9f7409f1f93343c7d9c676985b9a3759388835880e7e376451e89294654cb4fc0f6c6386876896da50347c8bc4a98b80b1825cd5ef

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4508 PING.EXE

pid	process
4508	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.execmd.exe

description	pid	process	target process
PID 2440 wrote to memory of 4552	2440	rundll32.exe	cmd.exe
PID 2440 wrote to memory of 4552	2440	rundll32.exe	cmd.exe
PID 4552 wrote to memory of 4508	4552	cmd.exe	PING.EXE
PID 4552 wrote to memory of 4508	4552	cmd.exe	PING.EXE
PID 4552 wrote to memory of 3960	4552	cmd.exe	rundll32.exe
PID 4552 wrote to memory of 3960	4552	cmd.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fileman.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440

C:\Windows\system32\cmd.exe
cmd /c ping 127.0.0.1 -n 6 -i 21 > NUL & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\fileman.dll", #1 ZF3bI6aD VI0rr2aG & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4552

C:\Windows\system32\PING.EXE
ping 127.0.0.1 -n 6 -i 21
3⤵
- Runs ping.exe
PID:4508

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\fileman.dll", #1 ZF3bI6aD VI0rr2aG
3⤵
PID:3960

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/2440-130-0x000001CB8A3C0000-0x000001CB8A3E0000-memory.dmp

Filesize
128KB

Download
memory/2440-132-0x000001CB8A3C0000-0x000001CB8A3E0000-memory.dmp

Filesize
128KB

Download
memory/3960-134-0x0000000000000000-mapping.dmp

Download
memory/3960-135-0x000001FC110E0000-0x000001FC11100000-memory.dmp

Filesize
128KB

Download
memory/4508-133-0x0000000000000000-mapping.dmp

Download
memory/4552-131-0x0000000000000000-mapping.dmp

Download