Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 17:47
Static task
static1
Behavioral task
behavioral1
Sample
6e2316bb2c6cb9c5e3c26398574e5548.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6e2316bb2c6cb9c5e3c26398574e5548.dll
Resource
win10v2004-20231215-en
General
-
Target
6e2316bb2c6cb9c5e3c26398574e5548.dll
-
Size
512KB
-
MD5
6e2316bb2c6cb9c5e3c26398574e5548
-
SHA1
81be2c346afec4bc248f6332bcb287b3bb6ea547
-
SHA256
016a36baa939016b069f379a632769eca6e77639543283583b1d5b675065279f
-
SHA512
c8efe49ab78db3f9e7e246ecd3624d91d16f076409414181a006e336640fc9b388acc8252a462241ca52afd6bc8265036fb40eff8e631c2f347af2389b821455
-
SSDEEP
6144:h8Hn6uhrFveAYc4653HZBM+knvzHHAg7Toh0QFFo3JpWPwM6mRolwzpSjeIUOe+N:h8BvjYc4cJCbHHZojuvXjZDeXGyK
Malware Config
Extracted
bazarloader
reddew28c.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1692-0-0x00000000004A0000-0x00000000004C8000-memory.dmp BazarLoaderVar6 behavioral1/memory/1692-1-0x00000000004A0000-0x00000000004C8000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6e2316bb2c6cb9c5e3c26398574e5548.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\system32\regsvr32.exe,DllRegisterServer {12196DC5-F59B-4754-91B3-B93CCB1A9CFD}1⤵