bazarloader | 845eb9098b4a5b366d578fb665e6e14c24a1703fe7c6c3447def026acfac259d

Analysis

max time kernel
138s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 14:44

Target

cbe21d2476581f644111521640d61ed5.dll
Size

752KB
MD5

cbe21d2476581f644111521640d61ed5
SHA1

223a129329d34def069bad1647b296e566875dff
SHA256

845eb9098b4a5b366d578fb665e6e14c24a1703fe7c6c3447def026acfac259d
SHA512

72e495b911a62c5f9089f33e3a72dcabdfd3f89b6f0b77882a79cca2f897e306274596bf7548411b6eed373f9dd772bd8ff518d61f9f42989e47b61ae047a3aa
SSDEEP

12288:KwjCELPU6Vfcjw92HrLC9CHx2UY6tML2rn65hYdJ7V:pLP1Zc7rmUoUY6t0Qn652j7V

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1712-0-0x0000000000180000-0x00000000001AA000-memory.dmp	BazarLoaderVar5
behavioral1/memory/1712-1-0x0000000000180000-0x00000000001AA000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

3 1712 rundll32.exe
5 1712 rundll32.exe
6 1712 rundll32.exe
7 1712 rundll32.exe
8 1712 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbe21d2476581f644111521640d61ed5.dll,#1
1⤵
- Blocklisted process makes network request
PID:1712

memory/1712-0-0x0000000000180000-0x00000000001AA000-memory.dmp

Filesize
168KB

Download
memory/1712-1-0x0000000000180000-0x00000000001AA000-memory.dmp

Filesize
168KB

Download