bazarloader | a4b7712e366ac9f0f276e8982f595711b6ae63a23ee9586f735bc70195e70f14 | Triage

Analysis

max time kernel
130s
max time network
144s
platform
windows7_x64
resource
win7-20220414-en
submitted
14-06-2022 11:31

Sharing

Report Analysis Logs

General

Target

ce5f14631cc3d294686a5038ce29b25b740f850a31b89caf57946f105199bddb.dll
Size

164KB
MD5

2fcfccf9fdcbdcb47c452ddd6ad0b3da
SHA1

68b8913af70f30d46cfe97e6419f6f2ab07af370
SHA256

ce5f14631cc3d294686a5038ce29b25b740f850a31b89caf57946f105199bddb
SHA512

0dcfd403fb5a3db73a21e2c46f55e1f0647e34c6bd9b4b602ee1a6c70249d9ecea23bb73e605722a17ee51a92295427f9d0e7b1a19e0696e8c2bce0f0c35a588

Score

10^/10

bazarloader dropper loader

Malware Config

Extracted

Family

bazarloader

C2

167.99.240.197

207.154.236.187

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1992-55-0x0000000001DB0000-0x0000000001EA2000-memory.dmp	BazarLoaderVar6
behavioral1/memory/908-56-0x0000000001CA0000-0x0000000001D92000-memory.dmp	BazarLoaderVar6
behavioral1/memory/908-57-0x0000000001CA0000-0x0000000001D92000-memory.dmp	BazarLoaderVar6

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ce5f14631cc3d294686a5038ce29b25b740f850a31b89caf57946f105199bddb.dll
1⤵
PID:1992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce5f14631cc3d294686a5038ce29b25b740f850a31b89caf57946f105199bddb.dll,DllRegisterServer {4F12173B-3DA8-4A58-B1BB-7432CD038032}
1⤵
PID:908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-56-0x0000000001CA0000-0x0000000001D92000-memory.dmp

Filesize
968KB

Download
memory/908-57-0x0000000001CA0000-0x0000000001D92000-memory.dmp

Filesize
968KB

Download
memory/1992-54-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x0000000001DB0000-0x0000000001EA2000-memory.dmp

Filesize
968KB

Download