Overview

overview

10

Static

static

3

0326acfc51...cc.dll

windows7-x64

10

0326acfc51...cc.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 03:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0326acfc5189de754bfc75d2d49114cc.dll

  • Size

    429KB

  • MD5

    0326acfc5189de754bfc75d2d49114cc

  • SHA1

    71120c623bffc633ea11eecb36b55ca03ef7f167

  • SHA256

    61043e6e6785a73aa964622059e9914aa1305ae8a3bbbf061201c769e139fefa

  • SHA512

    706c4f4a6d894e1b6ffe90859201a7dddfd8fbbdcd99f2dffb2436b42590fd9a68afd402b5d50441e92607708a76a9dba1a92186619655996e9979e5f282db27

  • SSDEEP

    12288:dCQXHfmzl5O43PLKOWVaLuox94QsbcG0CZgl:lOrO2PLKlVFox94QswTCel

Score
10/10
bazarloaderdropperloader

Malware Config

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Bazar/Team9 Loader payload 2 IoCs
  • Tries to connect to .bazar domain 1 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0326acfc5189de754bfc75d2d49114cc.dll
    1⤵
      PID:1416

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      6305066c2f97ab7ad3e2232405a71c06

      SHA1

      9e5187a03d1e5d3700f9a434f1b7559ae3557e9d

      SHA256

      e23dac4bda04188738e8a3ca43afec1ebb3319a64b9b6c5b399cb5ac2bb30c31

      SHA512

      250f25341552b461689e34f77f1eb18a54964e37e8a09c5bb9d74c606d10574b63a4762adb8bed32285b04e82a7674ec7def93fdc473f9c2a934607b7c789bb8

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Cab3F63.tmp
      Filesize

      50KB

      MD5

      c259151cc4706a108b2f9cc3dd29767c

      SHA1

      bd14c4b871abce6491747362226b80fa9d99335f

      SHA256

      1a77db2120829851714e50fb21ced3db1dd141e14083d9ce1bcec239085ebef3

      SHA512

      a18868f9ebfd1ebf18adc3abde3db0a4957c8f6c26ec04dba4dcc00741d67ef39e36e064f2e6f5245f9ee9c6f7c8b72b36d4a30a64b38ec6f15309a836db18f1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar413A.tmp
      Filesize

      13KB

      MD5

      636461dbfb294086a34a497f2b07c64c

      SHA1

      bd1ea4b925de947692cb58a3d1226d4eba6b5038

      SHA256

      78a97e860199fb54978ea306a8a3c1a82e8362fea3189e7b05e6aa176ef5272f

      SHA512

      03bc62689f517fddbefdcb09c1a09332d51f5e7c4a3ab36eef01a0312ba699a7492ae7512f6f40011a04ed62d97821ba04fffb6dc053c35e89dda29fc9d0af03

      Download Submit

    • memory/1416-0-0x0000000000690000-0x00000000006CE000-memory.dmp

      Filesize

      248KB

      Download

    • memory/1416-1-0x0000000000690000-0x00000000006CE000-memory.dmp

      Filesize

      248KB

      Download