bazarloader | 8f5cae81860564252a76f268555d693b56d3ef96934a5f04caf6b3b367435e1c

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2023 03:06

Target

9f707b0475bc26052e6361028de31ad1.dll
Size

161KB
MD5

9f707b0475bc26052e6361028de31ad1
SHA1

4245cbfc5ad14874f66cb874408b4db0251167a2
SHA256

8f5cae81860564252a76f268555d693b56d3ef96934a5f04caf6b3b367435e1c
SHA512

8cca3a0ef8ab37592a6f1bc7c577103b41b1574f352bd06d1ace949b5d7fd6ee5e301d0d01e59347c77d1f269ac5f80f9c325262d39a2f521f782a0264db431c
SSDEEP

3072:ii38S9kuloIc4XdL/9AWNCkEON54t6lb+DQReyVIj42UCjUuvu+:P38S97loI9xvPE/6lyDpyVIU24+

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/464-0-0x0000023F9BA50000-0x0000023F9BA64000-memory.dmp	BazarLoaderVar6
behavioral2/memory/3840-7-0x0000020EE7C00000-0x0000020EE7C14000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

17 464 rundll32.exe
84 464 rundll32.exe

flow	pid	process
17	464	rundll32.exe
84	464	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f707b0475bc26052e6361028de31ad1.dll,#1
1⤵
- Blocklisted process makes network request
PID:464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f707b0475bc26052e6361028de31ad1.dll,#1 105180711
1⤵
PID:3840

memory/464-0-0x0000023F9BA50000-0x0000023F9BA64000-memory.dmp

Filesize
80KB

Download
memory/3840-7-0x0000020EE7C00000-0x0000020EE7C14000-memory.dmp

Filesize
80KB

Download