Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 21:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa5883c31754f3eeeb53daddf700ce15.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa5883c31754f3eeeb53daddf700ce15.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
aa5883c31754f3eeeb53daddf700ce15.dll
-
Size
520KB
-
MD5
aa5883c31754f3eeeb53daddf700ce15
-
SHA1
c19347448014afa8133b33d3d7f96509273de17c
-
SHA256
f52beed1ca842d704ac58e08a1e7daab0f528174fc37e56daf2ca3d76b8728e3
-
SHA512
59839fe2d39f63b347b548fa98ff10fa0f5b78bb48b51676001603130623e1624348b00e8b3a8a5b28c2488e86be49bf2a13a05fecde4d573b16348de1c4cd65
-
SSDEEP
12288:O8KYOYtWKnEWooxIixB7u/3gDIXUzsd4:N6YtWKnEWo4Hu/3g8Xld
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-0-0x0000000000390000-0x00000000003BA000-memory.dmp BazarLoaderVar5 behavioral1/memory/1964-1-0x0000000000390000-0x00000000003BA000-memory.dmp BazarLoaderVar5 -
Blocklisted process makes network request 4 IoCs
Processes:
rundll32.exeflow pid process 3 1964 rundll32.exe 5 1964 rundll32.exe 6 1964 rundll32.exe 7 1964 rundll32.exe