bazarloader | a4b7712e366ac9f0f276e8982f595711b6ae63a23ee9586f735bc70195e70f14 | Triage

Analysis

max time kernel
132s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14-06-2022 11:31

Sharing

Report Analysis Logs

General

Target

ce5f14631cc3d294686a5038ce29b25b740f850a31b89caf57946f105199bddb.dll
Size

164KB
MD5

2fcfccf9fdcbdcb47c452ddd6ad0b3da
SHA1

68b8913af70f30d46cfe97e6419f6f2ab07af370
SHA256

ce5f14631cc3d294686a5038ce29b25b740f850a31b89caf57946f105199bddb
SHA512

0dcfd403fb5a3db73a21e2c46f55e1f0647e34c6bd9b4b602ee1a6c70249d9ecea23bb73e605722a17ee51a92295427f9d0e7b1a19e0696e8c2bce0f0c35a588

Score

10^/10

bazarloader dropper loader

Malware Config

Extracted

Family

bazarloader

C2

167.99.240.197

207.154.236.187

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3416-130-0x0000000002090000-0x0000000002182000-memory.dmp	BazarLoaderVar6
behavioral2/memory/4752-131-0x0000015B6FF40000-0x0000015B70032000-memory.dmp	BazarLoaderVar6
behavioral2/memory/3416-132-0x0000000002090000-0x0000000002182000-memory.dmp	BazarLoaderVar6

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ce5f14631cc3d294686a5038ce29b25b740f850a31b89caf57946f105199bddb.dll
1⤵
PID:3416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce5f14631cc3d294686a5038ce29b25b740f850a31b89caf57946f105199bddb.dll,DllRegisterServer {67AAC490-E5BE-42CA-8A75-22F1625498E0}
1⤵
PID:4752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3416-130-0x0000000002090000-0x0000000002182000-memory.dmp

Filesize
968KB

Download
memory/3416-132-0x0000000002090000-0x0000000002182000-memory.dmp

Filesize
968KB

Download
memory/4752-131-0x0000015B6FF40000-0x0000015B70032000-memory.dmp

Filesize
968KB

Download