bazarloader | 4e4c7f6c2c9c7b4d73b73b38132dc9972c7d1492d628fe5d4ffb9b105ac84799 | Triage

Analysis

max time kernel
80s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 13:44

Sharing

Report Analysis Logs

General

Target

3883bba6d366e73e63226f1e842b44e5.dll
Size

429KB
MD5

3883bba6d366e73e63226f1e842b44e5
SHA1

869e3dafe24ed7e764d489dd38048fee4ad91090
SHA256

4e4c7f6c2c9c7b4d73b73b38132dc9972c7d1492d628fe5d4ffb9b105ac84799
SHA512

f51f0bb734d389bbf3868ac5208cb582795977a961ad6b021dd11933090eafa1f47d0cb9e4b862859f4c2fd7772806bdf336aaebc95d49286f17b33db37c3423
SSDEEP

12288:dCQXHfmzl5O43PLKOWVaLuox94QsbcG0CZgL:lOrO2PLKlVFox94QswTCeL

Score

10^/10

bazarloader dropper loader

Malware Config

Signatures

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2400-0-0x00000000015F0000-0x000000000162E000-memory.dmp	BazarLoaderVar5
behavioral2/memory/2400-1-0x00000000015F0000-0x000000000162E000-memory.dmp	BazarLoaderVar5

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3883bba6d366e73e63226f1e842b44e5.dll
1⤵
PID:2400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2400-0-0x00000000015F0000-0x000000000162E000-memory.dmp

Filesize
248KB

Download
memory/2400-1-0x00000000015F0000-0x000000000162E000-memory.dmp

Filesize
248KB

Download