Analysis
- max time kernel
118s - max time network
131s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
31/12/2023, 03:25
General
- Target 264ee2148fd34018ee969a40fb148713.dll
- Size 1.0MB
- Sample231231-dytklsbfg2
- SHA256 2d1d9fe54857b61b2778926a9aca6b40ccccb9150fe5a024d7809786f07ca715
Score
10/10
Malware Config
Extracted
Family
-
bazarloader
C2
-
104.248.170.50
Signatures
- Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
- Bazar/Team9 Loader payload 4 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\264ee2148fd34018ee969a40fb148713.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\264ee2148fd34018ee969a40fb148713.dll,DllRegisterServer {4F06E868-286F-4461-A989-61CAB0704094}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2428-0-0x00000000005C0000-0x00000000005E7000-memory.dmp
memory/2428-3-0x00000000005C0000-0x00000000005E7000-memory.dmp
memory/2748-1-0x0000000000190000-0x00000000001B7000-memory.dmp
memory/2748-2-0x0000000000190000-0x00000000001B7000-memory.dmp