Analysis
-
max time kernel
146s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2023 21:21
Static task
static1
Behavioral task
behavioral1
Sample
f8fc113257931a242e05e8ff1bbf6f4e.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f8fc113257931a242e05e8ff1bbf6f4e.dll
Resource
win10v2004-20231215-en
General
-
Target
f8fc113257931a242e05e8ff1bbf6f4e.dll
-
Size
1.2MB
-
MD5
f8fc113257931a242e05e8ff1bbf6f4e
-
SHA1
7ceba552d12287198835472c7f56132a56568c7d
-
SHA256
3a1434c46c588441cecde2d684b320ac38473c775449def61affc37a1a57eeea
-
SHA512
dd7218dd2194d44d66579d5100e11236d86ec4eea2549e4daf1ee893c338f7f1d6487c75acd6cdc7395783db073feca074e7e87d59c2f0ab40b12f048760c558
-
SSDEEP
24576:0Wpc+G43nwqthqmmldpXoQ5IyXdLrgvHmrc:8+n3Hthqm9qgkc
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/396-0-0x0000023CF95A0000-0x0000023CF95DB000-memory.dmp BazarLoaderVar5 behavioral2/memory/396-1-0x00007FFCC4C80000-0x00007FFCC4E02000-memory.dmp BazarLoaderVar5 behavioral2/memory/396-3-0x0000023CF95A0000-0x0000023CF95DB000-memory.dmp BazarLoaderVar5 -
Blocklisted process makes network request 11 IoCs
Processes:
rundll32.exeflow pid process 41 396 rundll32.exe 56 396 rundll32.exe 75 396 rundll32.exe 77 396 rundll32.exe 79 396 rundll32.exe 83 396 rundll32.exe 84 396 rundll32.exe 94 396 rundll32.exe 95 396 rundll32.exe 147 396 rundll32.exe 148 396 rundll32.exe -
Tries to connect to .bazar domain 2 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
Processes:
flow ioc 83 greencloud46a.bazar 94 whitestorm9p.bazar -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 195.10.195.195 Destination IP 195.10.195.195 -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
description flow ioc HTTP URL 75 https://api.opennicproject.org/geoip/?bare&ipv=4