Analysis
-
max time kernel
139s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 20:07
Static task
static1
Behavioral task
behavioral1
Sample
8e071a00bc9b5414ad3f4dcbf97cc8a9.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8e071a00bc9b5414ad3f4dcbf97cc8a9.dll
Resource
win10v2004-20231215-en
General
-
Target
8e071a00bc9b5414ad3f4dcbf97cc8a9.dll
-
Size
512KB
-
MD5
8e071a00bc9b5414ad3f4dcbf97cc8a9
-
SHA1
414264742503b5b9012dd73db5c561e3642fb62a
-
SHA256
968a9450cff6accf45665aa46adc0142140259017675df9ec4cda6c336addc04
-
SHA512
d2bddd879a1c88af00c8df2a6ae5378f80bb78545a5e58042b5ca395545a5594600ce900736303e26b9c6fd01f79ae94a9c88576164cbab9bea5a393382245b2
-
SSDEEP
6144:h8Hn6uhrFveAYc4653HZBM+knvzHHAg7Toh0QFFo3JpWPwM6mRolwzpSjeIUOe+D:h8BvjYc4cJCbHHZojuvXjZDeXGya
Malware Config
Extracted
bazarloader
reddew28c.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1972-0-0x00000000008B0000-0x00000000008D8000-memory.dmp BazarLoaderVar6 behavioral2/memory/1972-1-0x00000000008B0000-0x00000000008D8000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8e071a00bc9b5414ad3f4dcbf97cc8a9.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\system32\regsvr32.exe,DllRegisterServer {43288811-73BC-4A55-A443-324BE8BA560E}1⤵