Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19-12-2023 12:55
General
-
Target
2a2dd2c7969c12c1202e16e0a9e33a2e.dll
-
Size
752KB
-
MD5
2a2dd2c7969c12c1202e16e0a9e33a2e
-
SHA1
578de23c3b1ecc8c1a357da622d9a516a27e3dd3
-
SHA256
d14f75f7eb189289fddfc70e7096afd53640efa043f94427c8d08e633593c261
-
SHA512
0074e55ff2ef09a58a8506926f03e39d3522e8b8af6b9dc6143bce3ee435a8cf554e5d0049b705f36c043007076203ba3c9af159ccadb20b6264d89d52b12268
-
SSDEEP
12288:fT4Hx+QLMJYKYcBH6Z7t7GMVR7pM7L2rn65hYZJA0Q:6+QIma+7t7ZP7iQn652XA
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 2 IoCs
-
Blocklisted process makes network request 8 IoCs
-
Tries to connect to .bazar domain 2 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2dd2c7969c12c1202e16e0a9e33a2e.dll,#11⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
-
Filesize
168KB