Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04-01-2024 05:15
Static task
static1
Behavioral task
behavioral1
Sample
3ffc127bc4ba53142f72726a8773c89a.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3ffc127bc4ba53142f72726a8773c89a.dll
Resource
win10v2004-20231222-en
General
-
Target
3ffc127bc4ba53142f72726a8773c89a.dll
-
Size
164KB
-
MD5
3ffc127bc4ba53142f72726a8773c89a
-
SHA1
440f138dd21b3a7698c97ff962f0249a3a8d2480
-
SHA256
36b8dccda54d3f559a39389e1ca62dc7e68ab915c4b122f090f6e11398000b02
-
SHA512
2622a04ee46d2cedc19309edcce339fdaaf9a4cb0e414798f1f1251d9cee739b54eb683bbf75256e58b597a4ecda09a839b9485466d305cd98a80c43b9742c93
-
SSDEEP
3072:cTltpXTmRUD82PbjCb5lcUpLhUf05x97bsqWpaM0fB8U6xcBwVSuU1E7YbqnOuOy:CuC7jj05CUpLhUsj97hM28xmwUuUKkbO
Malware Config
Extracted
bazarloader
167.99.240.197
207.154.236.187
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/3028-0-0x0000000001EC0000-0x0000000001FB2000-memory.dmp BazarLoaderVar6 behavioral1/memory/2284-1-0x0000000001BA0000-0x0000000001C92000-memory.dmp BazarLoaderVar6 behavioral1/memory/2284-2-0x0000000001BA0000-0x0000000001C92000-memory.dmp BazarLoaderVar6 behavioral1/memory/3028-3-0x0000000001EC0000-0x0000000001FB2000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3ffc127bc4ba53142f72726a8773c89a.dll1⤵PID:3028
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ffc127bc4ba53142f72726a8773c89a.dll,DllRegisterServer {25694E26-18DE-4D4D-89B1-BAF36875F43A}1⤵PID:2284
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2284-1-0x0000000001BA0000-0x0000000001C92000-memory.dmpFilesize
968KB
-
memory/2284-2-0x0000000001BA0000-0x0000000001C92000-memory.dmpFilesize
968KB
-
memory/3028-0-0x0000000001EC0000-0x0000000001FB2000-memory.dmpFilesize
968KB
-
memory/3028-3-0x0000000001EC0000-0x0000000001FB2000-memory.dmpFilesize
968KB