bazarloader | 0a87bd3bb60320b21e493341b70519af4e46c2e969038d6d89b536cd37aa11d9

Analysis

Target

09c6ae06e0c10672d91f6850118f41dc3dd66e72.dll
Size

513KB
MD5

b80f4b91c29963df1cfd0d0a8a30e5c6
SHA1

09c6ae06e0c10672d91f6850118f41dc3dd66e72
SHA256

0a87bd3bb60320b21e493341b70519af4e46c2e969038d6d89b536cd37aa11d9
SHA512

bdcd3009ed3499055cf73ef1c4dd4bd0942c8b81c395cecf3c9da790e4867055059d10b05451476d7da98bbbf472c40536e7a09158b5de92c57a74e36396d10c

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1988-58-0x0000000074D00000-0x0000000074E8C000-memory.dmp	BazarLoaderVar6
behavioral1/memory/1988-57-0x0000000074D00000-0x0000000074D28000-memory.dmp	BazarLoaderVar6
behavioral1/memory/1988-60-0x0000000074D00000-0x0000000074E8C000-memory.dmp	BazarLoaderVar6

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09c6ae06e0c10672d91f6850118f41dc3dd66e72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09c6ae06e0c10672d91f6850118f41dc3dd66e72.dll,#1
2⤵
PID:1988

memory/1988-54-0x0000000000000000-mapping.dmp

Download
memory/1988-55-0x0000000076781000-0x0000000076783000-memory.dmp

Filesize
8KB

Download
memory/1988-56-0x0000000074D00000-0x0000000074E8C000-memory.dmp

Filesize
1.5MB

Download
memory/1988-58-0x0000000074D00000-0x0000000074E8C000-memory.dmp

Filesize
1.5MB

Download
memory/1988-57-0x0000000074D00000-0x0000000074D28000-memory.dmp

Filesize
160KB

Download
memory/1988-60-0x0000000074D00000-0x0000000074E8C000-memory.dmp

Filesize
1.5MB

Download