Analysis

  • max time kernel
    147s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 01:07

General

  • Target

    1f45bcf1fb8b7ef74a57d19a371f41cf.dll

  • Size

    1.3MB

  • MD5

    1f45bcf1fb8b7ef74a57d19a371f41cf

  • SHA1

    9b7f346a04f8481c22fb6f8853f76349402a7009

  • SHA256

    aee116011409a5bec7d356bd8f704df0a361fb029bf20178d49e02607798d9a1

  • SHA512

    6cdbc392b650420d9238d7400956fa41ec9ede827576b9023b977e232dd18b3dd72f36082fc6cdb5af7f62868b0bd00e9b718522799467c674efb6202a169f9f

  • SSDEEP

    24576:ax12nIqqCgOgFO9fccuUMHKv+i7e1LXEdFoGzIyXjxeKr:aYIqJPV9fcHqmGSr9or

Malware Config

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

  • Bazar/Team9 Loader payload 6 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1f45bcf1fb8b7ef74a57d19a371f41cf.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\system32\cmd.exe
      cmd /c ping 127.0.0.1 -n 8 & "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\1f45bcf1fb8b7ef74a57d19a371f41cf.dll" mscp ahis & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Windows\system32\PING.EXE
        ping 127.0.0.1 -n 8
        3⤵
        • Runs ping.exe
        PID:3024
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\1f45bcf1fb8b7ef74a57d19a371f41cf.dll" mscp ahis
        3⤵
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        PID:2888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2888-11-0x0000000027480000-0x00000000274E4000-memory.dmp

    Filesize

    400KB

  • memory/2888-12-0x000007FEF6C30000-0x000007FEF6DD2000-memory.dmp

    Filesize

    1.6MB

  • memory/2988-0-0x0000000001F10000-0x0000000001F74000-memory.dmp

    Filesize

    400KB

  • memory/2988-1-0x000007FEF6F10000-0x000007FEF70B2000-memory.dmp

    Filesize

    1.6MB

  • memory/2988-9-0x000007FEF6F10000-0x000007FEF70B2000-memory.dmp

    Filesize

    1.6MB

  • memory/2988-10-0x0000000001F10000-0x0000000001F74000-memory.dmp

    Filesize

    400KB