Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
30/12/2023, 04:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f003a54e0e52efd49c31376687eac41.dll
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f003a54e0e52efd49c31376687eac41.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 0f003a54e0e52efd49c31376687eac41.dll
- Size 338KB
- Sample231230-fe9tlagbam
- SHA256 8fccef8c77091c260d0926d4ebe9ee80d79be2262360679a4d59c2a6efeca7ab
- MD5 0f003a54e0e52efd49c31376687eac41
- SHA1 3f2cd9ca8778d2814fa6e32b1827db2f57b25e6c
- SHA512 ad8530a5df15895f813935bc6fea24a6c11ebf5733f2d99cb6a5b2cbfa9e4d220965e7e2c087659e51b31916a51fdfeca3536c065a561a2c9fed382c9795d059
- SSDEEP 6144:uZwKn8bxurvfUCEs7I4V2PsqHMc/PZ6RguROla0CWecIdn9TCwC6dT:zTbxuLfUCR2kQMgZ6W4OIePAT
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
- Bazar/Team9 Loader payload 2 IoCs
resource yara_rule behavioral2/memory/4648-0-0x00000177E64C0000-0x00000177E66BA000-memory.dmp BazarLoaderVar5 behavioral2/memory/4648-1-0x00000177E64C0000-0x00000177E66BA000-memory.dmp BazarLoaderVar5 - Blocklisted process makes network request 16 IoCs
flow pid Process 34 4648 rundll32.exe 54 4648 rundll32.exe 68 4648 rundll32.exe 110 4648 rundll32.exe 122 4648 rundll32.exe 124 4648 rundll32.exe 147 4648 rundll32.exe 148 4648 rundll32.exe 184 4648 rundll32.exe 187 4648 rundll32.exe 189 4648 rundll32.exe 192 4648 rundll32.exe 193 4648 rundll32.exe 198 4648 rundll32.exe 199 4648 rundll32.exe 201 4648 rundll32.exe - Tries to connect to .bazar domain 10 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
flow ioc 187 yellowdownpour81.bazar 189 yellowdownpour81.bazar 192 yellowdownpour81.bazar 198 yellowdownpour81.bazar 199 yellowdownpour81.bazar 122 greencloud46a.bazar 147 whitestorm9p.bazar 184 yellowdownpour81.bazar 193 yellowdownpour81.bazar 201 yellowdownpour81.bazar - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 198.50.135.212 Destination IP 51.89.88.77 Destination IP 134.195.4.2 Destination IP 194.36.144.87 Destination IP 217.160.188.24 Destination IP 134.195.4.2 Destination IP 217.160.188.24 Destination IP 185.84.81.194 Destination IP 78.31.67.99 Destination IP 134.195.4.2