Overview

overview

10

Static

static

3

0326acfc51...cc.dll

windows7-x64

10

0326acfc51...cc.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    135s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29-12-2023 20:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0326acfc5189de754bfc75d2d49114cc.dll

  • Size

    429KB

  • MD5

    0326acfc5189de754bfc75d2d49114cc

  • SHA1

    71120c623bffc633ea11eecb36b55ca03ef7f167

  • SHA256

    61043e6e6785a73aa964622059e9914aa1305ae8a3bbbf061201c769e139fefa

  • SHA512

    706c4f4a6d894e1b6ffe90859201a7dddfd8fbbdcd99f2dffb2436b42590fd9a68afd402b5d50441e92607708a76a9dba1a92186619655996e9979e5f282db27

  • SSDEEP

    12288:dCQXHfmzl5O43PLKOWVaLuox94QsbcG0CZgl:lOrO2PLKlVFox94QswTCel

Score
10/10
bazarloaderdropperloader

Malware Config

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Bazar/Team9 Loader payload 2 IoCs
  • Tries to connect to .bazar domain 1 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0326acfc5189de754bfc75d2d49114cc.dll
    1⤵
      PID:2248

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      da0b8f8ac54cf5c39d6fd5492d409293

      SHA1

      b35a5b19b625e73a94db5c2da379b6b54cbaa00c

      SHA256

      fc5dae0c613ee7672f141861661def96c61eeab8dd89c05fe960ab33133705af

      SHA512

      b234cd5e93636c888bfd9c55e52aea8d6e8d8b0765b7b3947cbb8a7d9aee6222b285feb24512842e09ab1f4693e4f8b29428fc9373c95f5a43fb61f35343d9b4

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\Cab2F6C.tmp
      Filesize

      47KB

      MD5

      63bcada0668e1b6088bd51d01dcf08e2

      SHA1

      4f00b16387dad5b883fa835ced630471708f1b46

      SHA256

      fd40858c5435841bee2160a76362d96249c0ffbc703548b26628c87404417dc3

      SHA512

      fce2c321a88b62ba8908fa60470e9bcf3ea0b91b1654ea458c7f2b0269d4ea5360595c7ca6f09dd96a549586e8479d43b953de53ced628c4b8fc271cb8dd613d

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\Tar30D5.tmp
      Filesize

      60KB

      MD5

      09301f960fb80848c7e16735e65523fd

      SHA1

      d9e69927d66e4fcf94d486c81253161aae6eba6a

      SHA256

      f447131b6b64e83025464b46f7a78502d6dac14e2c322d72b328d6875c768bf0

      SHA512

      1e70bd76c1b7a8a5e1a4a9baf5f9feba479a762fed152014c2aa47e030b3625d97a35bf24126ac40a0dd28c508a3f110f4822a963ed174bef89498a5c1b2388a

      Download Submit
    • memory/2248-0-0x0000000000400000-0x000000000043E000-memory.dmp
      Filesize

      248KB

      Download
    • memory/2248-1-0x0000000000400000-0x000000000043E000-memory.dmp
      Filesize

      248KB

      Download