Analysis
-
max time kernel
600s -
max time network
601s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-10-2022 21:56
Static task
static1
Behavioral task
behavioral1
Sample
1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27.dll
Resource
win10v2004-20220901-en
General
-
Target
1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27.dll
-
Size
451KB
-
MD5
03a65801edbd3c3a8773b8f055d896e6
-
SHA1
393585b8e46880d537d771cfeb0061ad53345c77
-
SHA256
1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27
-
SHA512
17012ab456d5f0f1f5e95fe5d837ad424ded05dd83c249cb871d640dfe9c90f5008cb68814ce31d82a5156b6453b4391c4e91d9186bb9737e344ee7000d17718
-
SSDEEP
6144:3xd0pFLXGPKoQjVyhTmTi7yW26ixVgBEjhuky5NPa2u8ol7LHwNobSkQ+o4uEg8X:hdg1WPwjVeCW2jRy3a2Wjwvcg8sY
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1944-57-0x0000000180000000-0x0000000180019000-memory.dmp BazarLoaderVar6 behavioral1/memory/1944-58-0x0000000180000000-0x0000000180019000-memory.dmp BazarLoaderVar6 behavioral1/memory/616-61-0x0000000180000000-0x0000000180019000-memory.dmp BazarLoaderVar6 behavioral1/memory/616-62-0x0000000180000000-0x0000000180019000-memory.dmp BazarLoaderVar6 behavioral1/memory/616-63-0x0000000180000000-0x0000000180019000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\1944514e7e2dfe6295b69d967d74da2dd4ee9df351c26e74f6c89e72e6e8bf27.dll,DllRegisterServer {2BA7FB84-3D7B-414D-A9D7-D4B09639ED14}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/616-61-0x0000000180000000-0x0000000180019000-memory.dmpFilesize
100KB
-
memory/616-62-0x0000000180000000-0x0000000180019000-memory.dmpFilesize
100KB
-
memory/616-63-0x0000000180000000-0x0000000180019000-memory.dmpFilesize
100KB
-
memory/1944-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmpFilesize
8KB
-
memory/1944-55-0x0000000000140000-0x0000000000154000-memory.dmpFilesize
80KB
-
memory/1944-57-0x0000000180000000-0x0000000180019000-memory.dmpFilesize
100KB
-
memory/1944-58-0x0000000180000000-0x0000000180019000-memory.dmpFilesize
100KB