Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
26-12-2023 02:52
General
-
Target
4e02ce310c2b7a1cebb58714781de17a.dll
-
Size
338KB
-
MD5
4e02ce310c2b7a1cebb58714781de17a
-
SHA1
48eb0eae7c68be446d6bdc9f44bd2ee2e286f2cf
-
SHA256
56772dca4331188918e3763a9e934e9c8e5994c06daf158f745419a4256dac91
-
SHA512
1e384b595802ac9a153a578ac617ef421aa6fd7cfd9bfc10f0ab4ddaffd2f2be7fac6bb377eebe3c60c6f97ca4b29617de2925520bde524c70ff03d896b3d99e
-
SSDEEP
6144:uZwKn8bxurvfUCEs7I4V2PsqHMc/PZ6RguROla0CWecIdn9TCwC6dU:zTbxuLfUCR2kQMgZ6W4OIePAU
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 2 IoCs
-
Blocklisted process makes network request 10 IoCs
-
Tries to connect to .bazar domain 1 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4e02ce310c2b7a1cebb58714781de17a.dll,#11⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2864-0-0x0000000001E70000-0x000000000206A000-memory.dmpFilesize
2.0MB
-
memory/2864-1-0x0000000001E70000-0x000000000206A000-memory.dmpFilesize
2.0MB