bazarloader | 33578b9c002760c65df50edee28db75dab43e5e55019852cd63d77e5c870c06f

Analysis

max time kernel
124s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 13:13

Target

20e3b7d04d121321733b6eb698a09138.dll
Size

164KB
MD5

20e3b7d04d121321733b6eb698a09138
SHA1

5e1f1b0fb181c523db6d58ccc8eb91f43231457a
SHA256

33578b9c002760c65df50edee28db75dab43e5e55019852cd63d77e5c870c06f
SHA512

52282718088e24a82aad2f084a64629004737f8f0569ddcb1128b629f6fba13686b48d48fa886ff0c6fe10d3c9a1b70835f7d0ba939297ff1b432e41fe27518f
SSDEEP

3072:iEBgM/gPzVNBoQxJbhzHZJ6uwNHNhqlHSSseyVIj42zCgwUzHLg:ij3PBoQRzHZr4hqVS6yVIU2X

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2432-0-0x0000000001D30000-0x0000000001D44000-memory.dmp	BazarLoaderVar6
behavioral1/memory/2288-7-0x00000000001A0000-0x00000000001B4000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

3 2432 rundll32.exe
6 2432 rundll32.exe
7 2432 rundll32.exe
8 2432 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\20e3b7d04d121321733b6eb698a09138.dll,#1
1⤵
- Blocklisted process makes network request
PID:2432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\20e3b7d04d121321733b6eb698a09138.dll,#1 3854964114
1⤵
PID:2288

memory/2288-7-0x00000000001A0000-0x00000000001B4000-memory.dmp

Filesize
80KB

Download
memory/2432-0-0x0000000001D30000-0x0000000001D44000-memory.dmp

Filesize
80KB

Download