bazarloader | b51cb6fa584a073fe95bcf8749cf84363cb431f520a5d97cec92aae88329b7cb | Triage

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 12:44

Sharing

Report Analysis Logs

General

Target

fileman.dll
Size

213KB
MD5

6f3be0dfe6b5971b16464b7924772445
SHA1

8af5e975c00f5bdbd843f644a60adbb5f8da8a0d
SHA256

b51cb6fa584a073fe95bcf8749cf84363cb431f520a5d97cec92aae88329b7cb
SHA512

a1a8d49ec7610c37284a2e9f7409f1f93343c7d9c676985b9a3759388835880e7e376451e89294654cb4fc0f6c6386876896da50347c8bc4a98b80b1825cd5ef
SSDEEP

3072:GmmcI7/mAuyLKfrsP5PUD1jB8pZbiYbrmdwDb2lyZi4oRWLuaW5FxvwR0N:/jI7uzfrkAjBoZ1bRi2JYx

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1616 timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.execmd.exe

description	pid	process	target process
PID 4412 wrote to memory of 1300	4412	rundll32.exe	cmd.exe
PID 4412 wrote to memory of 1300	4412	rundll32.exe	cmd.exe
PID 1300 wrote to memory of 1616	1300	cmd.exe	timeout.exe
PID 1300 wrote to memory of 1616	1300	cmd.exe	timeout.exe
PID 1300 wrote to memory of 1652	1300	cmd.exe	rundll32.exe
PID 1300 wrote to memory of 1652	1300	cmd.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fileman.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4412

C:\Windows\system32\cmd.exe
cmd /c timeout /t 6 /nobreak > NUL & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\fileman.dll", #1 ZF3bI6aD VI0rr2aG & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\system32\timeout.exe
timeout /t 6 /nobreak
3⤵
- Delays execution with timeout.exe
PID:1616

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\fileman.dll", #1 ZF3bI6aD VI0rr2aG
3⤵
PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-135-0x000001A7C7D10000-0x000001A7C7D30000-memory.dmp

Filesize
128KB

Download
memory/4412-133-0x0000015642560000-0x0000015642580000-memory.dmp

Filesize
128KB

Download
memory/4412-134-0x0000015642560000-0x0000015642580000-memory.dmp

Filesize
128KB

Download