bazarloader | 0a87bd3bb60320b21e493341b70519af4e46c2e969038d6d89b536cd37aa11d9

Analysis

Target

09c6ae06e0c10672d91f6850118f41dc3dd66e72.dll
Size

513KB
MD5

b80f4b91c29963df1cfd0d0a8a30e5c6
SHA1

09c6ae06e0c10672d91f6850118f41dc3dd66e72
SHA256

0a87bd3bb60320b21e493341b70519af4e46c2e969038d6d89b536cd37aa11d9
SHA512

bdcd3009ed3499055cf73ef1c4dd4bd0942c8b81c395cecf3c9da790e4867055059d10b05451476d7da98bbbf472c40536e7a09158b5de92c57a74e36396d10c

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4264-132-0x0000000075080000-0x00000000750A8000-memory.dmp	BazarLoaderVar6
behavioral2/memory/4264-133-0x0000000075080000-0x000000007520C000-memory.dmp	BazarLoaderVar6
behavioral2/memory/4264-135-0x0000000075080000-0x000000007520C000-memory.dmp	BazarLoaderVar6
behavioral2/memory/4264-136-0x0000000075080000-0x000000007520C000-memory.dmp	BazarLoaderVar6
behavioral2/memory/956-139-0x0000000075080000-0x000000007520C000-memory.dmp	BazarLoaderVar6
behavioral2/memory/956-141-0x0000000075080000-0x000000007520C000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

38 4264 rundll32.exe
44 4264 rundll32.exe
47 4264 rundll32.exe
50 4264 rundll32.exe
51 4264 rundll32.exe
52 4264 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1496 wrote to memory of 4264	1496	rundll32.exe	rundll32.exe
PID 1496 wrote to memory of 4264	1496	rundll32.exe	rundll32.exe
PID 1496 wrote to memory of 4264	1496	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09c6ae06e0c10672d91f6850118f41dc3dd66e72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09c6ae06e0c10672d91f6850118f41dc3dd66e72.dll,#1
2⤵
- Blocklisted process makes network request
PID:4264

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\09c6ae06e0c10672d91f6850118f41dc3dd66e72.dll,PluginInit 2382261556
1⤵
PID:956

memory/956-137-0x0000000075080000-0x000000007520C000-memory.dmp

Filesize
1.5MB

Download
memory/956-139-0x0000000075080000-0x000000007520C000-memory.dmp

Filesize
1.5MB

Download
memory/956-141-0x0000000075080000-0x000000007520C000-memory.dmp

Filesize
1.5MB

Download
memory/4264-130-0x0000000000000000-mapping.dmp

Download
memory/4264-131-0x0000000075080000-0x000000007520C000-memory.dmp

Filesize
1.5MB

Download
memory/4264-132-0x0000000075080000-0x00000000750A8000-memory.dmp

Filesize
160KB

Download
memory/4264-133-0x0000000075080000-0x000000007520C000-memory.dmp

Filesize
1.5MB

Download
memory/4264-135-0x0000000075080000-0x000000007520C000-memory.dmp

Filesize
1.5MB

Download
memory/4264-136-0x0000000075080000-0x000000007520C000-memory.dmp

Filesize
1.5MB

Download