Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 17:47
Static task
static1
Behavioral task
behavioral1
Sample
6e2316bb2c6cb9c5e3c26398574e5548.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6e2316bb2c6cb9c5e3c26398574e5548.dll
Resource
win10v2004-20231215-en
General
-
Target
6e2316bb2c6cb9c5e3c26398574e5548.dll
-
Size
512KB
-
MD5
6e2316bb2c6cb9c5e3c26398574e5548
-
SHA1
81be2c346afec4bc248f6332bcb287b3bb6ea547
-
SHA256
016a36baa939016b069f379a632769eca6e77639543283583b1d5b675065279f
-
SHA512
c8efe49ab78db3f9e7e246ecd3624d91d16f076409414181a006e336640fc9b388acc8252a462241ca52afd6bc8265036fb40eff8e631c2f347af2389b821455
-
SSDEEP
6144:h8Hn6uhrFveAYc4653HZBM+knvzHHAg7Toh0QFFo3JpWPwM6mRolwzpSjeIUOe+N:h8BvjYc4cJCbHHZojuvXjZDeXGyK
Malware Config
Extracted
bazarloader
reddew28c.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3076-0-0x00000000008D0000-0x00000000008F8000-memory.dmp BazarLoaderVar6 behavioral2/memory/3076-1-0x00000000008D0000-0x00000000008F8000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6e2316bb2c6cb9c5e3c26398574e5548.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\system32\regsvr32.exe,DllRegisterServer {9D37E2C4-0DEC-4469-BB18-31C08345AE2B}1⤵