bazarloader | 8f5cae81860564252a76f268555d693b56d3ef96934a5f04caf6b3b367435e1c

Analysis

max time kernel
124s
max time network
135s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-12-2023 03:06

Target

9f707b0475bc26052e6361028de31ad1.dll
Size

161KB
MD5

9f707b0475bc26052e6361028de31ad1
SHA1

4245cbfc5ad14874f66cb874408b4db0251167a2
SHA256

8f5cae81860564252a76f268555d693b56d3ef96934a5f04caf6b3b367435e1c
SHA512

8cca3a0ef8ab37592a6f1bc7c577103b41b1574f352bd06d1ace949b5d7fd6ee5e301d0d01e59347c77d1f269ac5f80f9c325262d39a2f521f782a0264db431c
SSDEEP

3072:ii38S9kuloIc4XdL/9AWNCkEON54t6lb+DQReyVIj42UCjUuvu+:P38S97loI9xvPE/6lyDpyVIU24+

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2900-0-0x0000000000150000-0x0000000000164000-memory.dmp	BazarLoaderVar6
behavioral1/memory/3016-7-0x0000000000260000-0x0000000000274000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

3 2900 rundll32.exe
8 2900 rundll32.exe
9 2900 rundll32.exe
10 2900 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f707b0475bc26052e6361028de31ad1.dll,#1
1⤵
- Blocklisted process makes network request
PID:2900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f707b0475bc26052e6361028de31ad1.dll,#1 3624236814
1⤵
PID:3016

memory/2900-0-0x0000000000150000-0x0000000000164000-memory.dmp

Filesize
80KB

Download
memory/3016-7-0x0000000000260000-0x0000000000274000-memory.dmp

Filesize
80KB

Download