Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 02:54
Static task
static1
Behavioral task
behavioral1
Sample
2552f71685c4bd3379ebc4f971bf26c6.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2552f71685c4bd3379ebc4f971bf26c6.dll
Resource
win10v2004-20231215-en
General
-
Target
2552f71685c4bd3379ebc4f971bf26c6.dll
-
Size
937KB
-
MD5
2552f71685c4bd3379ebc4f971bf26c6
-
SHA1
c610f0d02412a6e4f34c83ec293e737d0579c407
-
SHA256
612f74d0a1f2f90a5a4ae11889755ea68656967cf0401e15d9c375ddcfb1d9e7
-
SHA512
3ca8e82cd62f1d1bbc1ae243c0e801e71bf4b1a7ed1d3a2eaaa0c0b30150e4d59957361f0d17c810b077657d484b63d0b878bea957662da83fa29ed39a5c7693
-
SSDEEP
12288:XNCXFv5G77xLH0PpGzHcHDN2gt2FbSe7ABgnjpTDGAmWjgU:E1h02sz8jN25kegGjtBJ
Malware Config
Extracted
bazarloader
128.199.54.51
161.35.152.204
161.35.95.166
whitestorm9p.bazar
yellowdownpour81.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/3064-0-0x00000000005A0000-0x00000000005B4000-memory.dmp BazarLoaderVar6 behavioral1/memory/2132-1-0x0000000000100000-0x0000000000114000-memory.dmp BazarLoaderVar6 behavioral1/memory/2132-2-0x0000000000100000-0x0000000000114000-memory.dmp BazarLoaderVar6 behavioral1/memory/3064-3-0x00000000005A0000-0x00000000005B4000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2552f71685c4bd3379ebc4f971bf26c6.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2552f71685c4bd3379ebc4f971bf26c6.dll,StartW {38E120DF-E6A3-48BB-A600-BAB38D9DD3B2}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2132-1-0x0000000000100000-0x0000000000114000-memory.dmpFilesize
80KB
-
memory/2132-2-0x0000000000100000-0x0000000000114000-memory.dmpFilesize
80KB
-
memory/3064-0-0x00000000005A0000-0x00000000005B4000-memory.dmpFilesize
80KB
-
memory/3064-3-0x00000000005A0000-0x00000000005B4000-memory.dmpFilesize
80KB