bazarloader | ce5ee2fd8aa4acda24baf6221b5de66220172da0eb312705936adc5b164cc052 | Triage

Analysis

max time kernel
147s
max time network
155s
platform
windows7_x64
resource
win7-20220414-en
submitted
15-07-2022 03:00

Sharing

Report Analysis Logs

General

Target

ce5ee2fd8aa4acda24baf6221b5de66220172da0eb312705936adc5b164cc052.dll
Size

611KB
MD5

df96269b0242bdb6a06621696f5d31cb
SHA1

db4ececac3eb4d38c632a6f83f42666bce0070ae
SHA256

ce5ee2fd8aa4acda24baf6221b5de66220172da0eb312705936adc5b164cc052
SHA512

e3b17f0640be0fc109d6247bae58711583f42152bb29f887e9f5ca456518f70d687d793278f19fde24419ff34ff5888ead43bc00a0bddbb6994f36d19f956f83

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/756-54-0x00000000003D0000-0x0000000000408000-memory.dmp	BazarLoaderVar5

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce5ee2fd8aa4acda24baf6221b5de66220172da0eb312705936adc5b164cc052.dll,#1
1⤵
PID:756

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-54-0x00000000003D0000-0x0000000000408000-memory.dmp

Filesize
224KB

Download