bazarloader | 2ecb7f64c75053239e5ded8ad8485c2dc8893b145822271d6902a7948d70aa4b | Triage

Analysis

max time kernel
112s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
04-06-2022 14:18

Sharing

Report Analysis Logs

General

Target

2ecb7f64c75053239e5ded8ad8485c2dc8893b145822271d6902a7948d70aa4b.dll
Size

710KB
MD5

0fd810942ae8887e6944ea662c77bdd0
SHA1

29e67f1842981dc2e9999fdb746400dbc7beeb4e
SHA256

2ecb7f64c75053239e5ded8ad8485c2dc8893b145822271d6902a7948d70aa4b
SHA512

71156aa6cd806c0356da16e0e8847959c9494e8af5485af16de7f0c37ba106b84ca7915fb7454167a34a7e7fae25b4bc4c53779c65ab72b270d011416718be35

Score

10^/10

bazarloader dropper loader

Malware Config

Extracted

Family

bazarloader

C2

reddew28c.bazar

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1684-130-0x00000238F93F0000-0x00000238F941B000-memory.dmp	BazarLoaderVar6
behavioral2/memory/1684-131-0x00000238F93F0000-0x00000238F941B000-memory.dmp	BazarLoaderVar6

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ecb7f64c75053239e5ded8ad8485c2dc8893b145822271d6902a7948d70aa4b.dll,#1
1⤵
PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-130-0x00000238F93F0000-0x00000238F941B000-memory.dmp

Filesize
172KB

Download
memory/1684-131-0x00000238F93F0000-0x00000238F941B000-memory.dmp

Filesize
172KB

Download