bazarloader | 0b7eafb0e73e2bf0e0c6263824ffacbf4869f9121502264e5dc08d09183ae301

Analysis

Target

images.exe
Size

290KB
MD5

e28ae2f26a165ab891248f17b064f2e7
SHA1

8ac67ed569b4675411c54ac05768eefff853854f
SHA256

0b7eafb0e73e2bf0e0c6263824ffacbf4869f9121502264e5dc08d09183ae301
SHA512

ba26ca25af0f1a5a5d4ec9c7fa1ba64e395d4c0a44b7803399df7dd50497addaa01ebf65d691c1f0a0a87462f0216aea60b9f4a6b3bffdc7c9743dc9e667c5b6

Score

10^/10

Family

bazarloader

144.217.50.242

5.39.63.103

94.140.113.53

185.163.45.95

reddew28c.bazar

bluehail.bazar

whitestorm9p.bazar

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2188 timeout.exe

pid	process
2188	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

images.execmd.exe

description	pid	process	target process
PID 1684 wrote to memory of 440	1684	images.exe	cmd.exe
PID 1684 wrote to memory of 440	1684	images.exe	cmd.exe
PID 440 wrote to memory of 2188	440	cmd.exe	timeout.exe
PID 440 wrote to memory of 2188	440	cmd.exe	timeout.exe
PID 440 wrote to memory of 2576	440	cmd.exe	images.exe
PID 440 wrote to memory of 2576	440	cmd.exe	images.exe

C:\Users\Admin\AppData\Local\Temp\images.exe
"C:\Users\Admin\AppData\Local\Temp\images.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SYSTEM32\cmd.exe
cmd /c timeout 6 & start "" "C:\Users\Admin\AppData\Local\Temp\images.exe" ZF3bI6aD VI0rr2aG & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:440

C:\Windows\system32\timeout.exe
timeout 6
3⤵
- Delays execution with timeout.exe
PID:2188

C:\Users\Admin\AppData\Local\Temp\images.exe
"C:\Users\Admin\AppData\Local\Temp\images.exe" ZF3bI6aD VI0rr2aG
3⤵
PID:2576

memory/440-131-0x0000000000000000-mapping.dmp

Download
memory/1684-130-0x00007FF4D0A40000-0x00007FF4D0A5F000-memory.dmp

Filesize
124KB

Download
memory/1684-133-0x00007FF4D0A40000-0x00007FF4D0A5F000-memory.dmp

Filesize
124KB

Download
memory/2188-132-0x0000000000000000-mapping.dmp

Download
memory/2576-134-0x0000000000000000-mapping.dmp

Download
memory/2576-135-0x00007FF41D540000-0x00007FF41D55F000-memory.dmp

Filesize
124KB

Download