Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27-12-2023 01:45
Static task
static1
Behavioral task
behavioral1
Sample
9bca58b356486c17aeb8f157f614acac.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9bca58b356486c17aeb8f157f614acac.dll
Resource
win10v2004-20231215-en
General
-
Target
9bca58b356486c17aeb8f157f614acac.dll
-
Size
1.2MB
-
MD5
9bca58b356486c17aeb8f157f614acac
-
SHA1
4421fbc98f0f0b87cc2912d668345fd5629d98ea
-
SHA256
37065b2a4cdaec2b1a260b39738746cb45895bd6d508e7aa5e4013e94abc6196
-
SHA512
a60d3d1dd58f1bfab0fecff45d34028f3adcb92d401d2846fed7eab82d1ac77837dfa4da2e19136005c7064d8037b4b50c43b63b0a0f1a419f0d46ca758caa5a
-
SSDEEP
12288:6yWeahQ/LWnzkXz5HYrniajhuSlHJzJBlPXXo/6aNdCaBSPZC1XZV72B7:HWeaZzqY7dhBjz/lfo/FIyXv72B7
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4148-0-0x0000021576030000-0x000002157606C000-memory.dmp BazarLoaderVar5 behavioral2/memory/4148-1-0x00007FFDEED60000-0x00007FFDEEEE1000-memory.dmp BazarLoaderVar5 behavioral2/memory/4148-3-0x0000021576030000-0x000002157606C000-memory.dmp BazarLoaderVar5 -
Blocklisted process makes network request 20 IoCs
Processes:
rundll32.exeflow pid process 36 4148 rundll32.exe 61 4148 rundll32.exe 84 4148 rundll32.exe 125 4148 rundll32.exe 129 4148 rundll32.exe 132 4148 rundll32.exe 134 4148 rundll32.exe 174 4148 rundll32.exe 138 4148 rundll32.exe 154 4148 rundll32.exe 157 4148 rundll32.exe 158 4148 rundll32.exe 163 4148 rundll32.exe 166 4148 rundll32.exe 167 4148 rundll32.exe 194 4148 rundll32.exe 195 4148 rundll32.exe 196 4148 rundll32.exe 200 4148 rundll32.exe 201 4148 rundll32.exe -
Tries to connect to .bazar domain 9 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
Processes:
flow ioc 158 whitestorm9p.bazar 166 whitestorm9p.bazar 167 whitestorm9p.bazar 194 whitestorm9p.bazar 195 whitestorm9p.bazar 154 whitestorm9p.bazar 163 whitestorm9p.bazar 200 yellowdownpour81.bazar 157 whitestorm9p.bazar -
Unexpected DNS network traffic destination 9 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 94.16.114.254 Destination IP 91.217.137.37 Destination IP 172.98.193.62 Destination IP 195.10.195.195 Destination IP 198.50.135.212 Destination IP 195.10.195.195 Destination IP 217.160.188.24 Destination IP 194.36.144.87 Destination IP 94.16.114.254