Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
30-12-2023 04:48
General
-
Target
0f003a54e0e52efd49c31376687eac41.dll
-
Size
338KB
-
MD5
0f003a54e0e52efd49c31376687eac41
-
SHA1
3f2cd9ca8778d2814fa6e32b1827db2f57b25e6c
-
SHA256
8fccef8c77091c260d0926d4ebe9ee80d79be2262360679a4d59c2a6efeca7ab
-
SHA512
ad8530a5df15895f813935bc6fea24a6c11ebf5733f2d99cb6a5b2cbfa9e4d220965e7e2c087659e51b31916a51fdfeca3536c065a561a2c9fed382c9795d059
-
SSDEEP
6144:uZwKn8bxurvfUCEs7I4V2PsqHMc/PZ6RguROla0CWecIdn9TCwC6dT:zTbxuLfUCR2kQMgZ6W4OIePAT
Score
10/10
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 2 IoCs
-
Blocklisted process makes network request 13 IoCs
-
Tries to connect to .bazar domain 2 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0f003a54e0e52efd49c31376687eac41.dll,#11⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1680-0-0x0000000001E40000-0x000000000203A000-memory.dmpFilesize
2.0MB
-
memory/1680-1-0x0000000001E40000-0x000000000203A000-memory.dmpFilesize
2.0MB