bazarloader | d14f75f7eb189289fddfc70e7096afd53640efa043f94427c8d08e633593c261

Analysis

max time kernel
140s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 12:55

Target

2a2dd2c7969c12c1202e16e0a9e33a2e.dll
Size

752KB
MD5

2a2dd2c7969c12c1202e16e0a9e33a2e
SHA1

578de23c3b1ecc8c1a357da622d9a516a27e3dd3
SHA256

d14f75f7eb189289fddfc70e7096afd53640efa043f94427c8d08e633593c261
SHA512

0074e55ff2ef09a58a8506926f03e39d3522e8b8af6b9dc6143bce3ee435a8cf554e5d0049b705f36c043007076203ba3c9af159ccadb20b6264d89d52b12268
SSDEEP

12288:fT4Hx+QLMJYKYcBH6Z7t7GMVR7pM7L2rn65hYZJA0Q:6+QIma+7t7ZP7iQn652XA

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2420-0-0x0000000000190000-0x00000000001BA000-memory.dmp	BazarLoaderVar5
behavioral1/memory/2420-1-0x0000000000190000-0x00000000001BA000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

3 2420 rundll32.exe
5 2420 rundll32.exe
6 2420 rundll32.exe
7 2420 rundll32.exe
8 2420 rundll32.exe
9 2420 rundll32.exe
13 2420 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2dd2c7969c12c1202e16e0a9e33a2e.dll,#1
1⤵
- Blocklisted process makes network request
PID:2420

memory/2420-0-0x0000000000190000-0x00000000001BA000-memory.dmp

Filesize
168KB

Download
memory/2420-1-0x0000000000190000-0x00000000001BA000-memory.dmp

Filesize
168KB

Download