Malware Analysis Report

2024-10-23 17:37

Sample ID 231219-p5vl2agecj
Target 2a2dd2c7969c12c1202e16e0a9e33a2e
SHA256 d14f75f7eb189289fddfc70e7096afd53640efa043f94427c8d08e633593c261
Tags
bazarloader dropper loader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d14f75f7eb189289fddfc70e7096afd53640efa043f94427c8d08e633593c261

Threat Level: Known bad

The file 2a2dd2c7969c12c1202e16e0a9e33a2e was found to be: Known bad.

Malicious Activity Summary

bazarloader dropper loader

Bazar Loader

Bazar/Team9 Loader payload

Blocklisted process makes network request

Tries to connect to .bazar domain

Unexpected DNS network traffic destination

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-12-19 12:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-19 12:55

Reported

2023-12-19 16:37

Platform

win7-20231215-en

Max time kernel

140s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2dd2c7969c12c1202e16e0a9e33a2e.dll,#1

Signatures

Bazar Loader

loader dropper bazarloader

Bazar/Team9 Loader payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2dd2c7969c12c1202e16e0a9e33a2e.dll,#1

Network

Country Destination Domain Proto
DE 104.248.16.136:443 tcp
DE 104.248.16.136:443 tcp
DE 164.90.223.38:443 tcp
DE 164.90.223.38:443 tcp
DE 164.90.223.1:443 tcp
DE 164.90.223.1:443 tcp
DE 164.90.223.13:443 tcp

Files

memory/2420-0-0x0000000000190000-0x00000000001BA000-memory.dmp

memory/2420-1-0x0000000000190000-0x00000000001BA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-19 12:55

Reported

2023-12-19 16:37

Platform

win10v2004-20231215-en

Max time kernel

138s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2dd2c7969c12c1202e16e0a9e33a2e.dll,#1

Signatures

Bazar Loader

loader dropper bazarloader

Bazar/Team9 Loader payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Tries to connect to .bazar domain

Description Indicator Process Target
N/A blackrain15.bazar N/A N/A
N/A reddew28c.bazar N/A N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 134.195.4.2 N/A N/A
Destination IP 134.195.4.2 N/A N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2dd2c7969c12c1202e16e0a9e33a2e.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 3.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
DE 104.248.16.136:443 tcp
DE 164.90.223.38:443 tcp
DE 164.90.223.1:443 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 61.179.17.96.in-addr.arpa udp
DE 164.90.223.13:443 tcp
US 134.195.4.2:53 blackrain15.bazar udp
PA 186.73.40.224:443 tcp
US 8.8.8.8:53 2.4.195.134.in-addr.arpa udp
US 134.195.4.2:53 reddew28c.bazar udp
PA 186.73.40.224:443 tcp

Files

memory/540-0-0x000002C361710000-0x000002C36173A000-memory.dmp

memory/540-1-0x000002C361710000-0x000002C36173A000-memory.dmp