bazarloader | 80ebf667875c94175c392e21ed3e52fc1ebf7f2460fd8a82d5cde4c732612762

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 21:45

Target

1d78af63cf39db93255eba78c469a598.dll
Size

409KB
MD5

1d78af63cf39db93255eba78c469a598
SHA1

6a41ff9c6f64875b29bc94dc110a7ec844dbbe45
SHA256

80ebf667875c94175c392e21ed3e52fc1ebf7f2460fd8a82d5cde4c732612762
SHA512

8f636135d412712196886c3a6193343ceb18f618e0e8d5248bdd3f06db5a6d2b2d2dbd474be246ab906f4a97b09f4680b10ec78ba38470f2db8cbb32ed251ed3
SSDEEP

6144:xZtl3Zvn1IqjyfeKZ1mTvMs4Kvx0rEp0YUUoIZD73hrbhYHtQZmskXE4wPS:1lg+yfeZ7vm4paUoED5buthskXhwPS

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2528-0-0x0000000000450000-0x000000000048C000-memory.dmp	BazarLoaderVar5
behavioral1/memory/2528-1-0x0000000000450000-0x000000000048C000-memory.dmp	BazarLoaderVar5

Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

2 2528 rundll32.exe
3 2528 rundll32.exe
4 2528 rundll32.exe
5 2528 rundll32.exe
6 2528 rundll32.exe
7 2528 rundll32.exe
8 2528 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d78af63cf39db93255eba78c469a598.dll,#1
1⤵
- Blocklisted process makes network request
PID:2528

memory/2528-0-0x0000000000450000-0x000000000048C000-memory.dmp

Filesize
240KB

Download
memory/2528-1-0x0000000000450000-0x000000000048C000-memory.dmp

Filesize
240KB

Download