Analysis
-
max time kernel
569s -
max time network
573s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-10-2022 22:14
Behavioral task
behavioral1
Sample
1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27_unpacked.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27_unpacked.dll
Resource
win10v2004-20220812-en
General
-
Target
1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27.dll
-
Size
451KB
-
MD5
03a65801edbd3c3a8773b8f055d896e6
-
SHA1
393585b8e46880d537d771cfeb0061ad53345c77
-
SHA256
1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27
-
SHA512
17012ab456d5f0f1f5e95fe5d837ad424ded05dd83c249cb871d640dfe9c90f5008cb68814ce31d82a5156b6453b4391c4e91d9186bb9737e344ee7000d17718
-
SSDEEP
6144:3xd0pFLXGPKoQjVyhTmTi7yW26ixVgBEjhuky5NPa2u8ol7LHwNobSkQ+o4uEg8X:hdg1WPwjVeCW2jRy3a2Wjwvcg8sY
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1956-57-0x0000000180000000-0x0000000180019000-memory.dmp BazarLoaderVar6 behavioral1/memory/1956-58-0x0000000180000000-0x0000000180019000-memory.dmp BazarLoaderVar6 behavioral1/memory/1784-61-0x0000000180000000-0x0000000180019000-memory.dmp BazarLoaderVar6 behavioral1/memory/1784-62-0x0000000180000000-0x0000000180019000-memory.dmp BazarLoaderVar6 behavioral1/memory/1784-63-0x0000000180000000-0x0000000180019000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27.dll,DllRegisterServer {1AF08F88-69EC-432D-A38B-5C9EACD5DA2B}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1784-61-0x0000000180000000-0x0000000180019000-memory.dmpFilesize
100KB
-
memory/1784-62-0x0000000180000000-0x0000000180019000-memory.dmpFilesize
100KB
-
memory/1784-63-0x0000000180000000-0x0000000180019000-memory.dmpFilesize
100KB
-
memory/1956-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmpFilesize
8KB
-
memory/1956-55-0x00000000003A0000-0x00000000003B4000-memory.dmpFilesize
80KB
-
memory/1956-57-0x0000000180000000-0x0000000180019000-memory.dmpFilesize
100KB
-
memory/1956-58-0x0000000180000000-0x0000000180019000-memory.dmpFilesize
100KB