Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2024 05:15
Static task
static1
Behavioral task
behavioral1
Sample
3ffc127bc4ba53142f72726a8773c89a.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3ffc127bc4ba53142f72726a8773c89a.dll
Resource
win10v2004-20231222-en
General
-
Target
3ffc127bc4ba53142f72726a8773c89a.dll
-
Size
164KB
-
MD5
3ffc127bc4ba53142f72726a8773c89a
-
SHA1
440f138dd21b3a7698c97ff962f0249a3a8d2480
-
SHA256
36b8dccda54d3f559a39389e1ca62dc7e68ab915c4b122f090f6e11398000b02
-
SHA512
2622a04ee46d2cedc19309edcce339fdaaf9a4cb0e414798f1f1251d9cee739b54eb683bbf75256e58b597a4ecda09a839b9485466d305cd98a80c43b9742c93
-
SSDEEP
3072:cTltpXTmRUD82PbjCb5lcUpLhUf05x97bsqWpaM0fB8U6xcBwVSuU1E7YbqnOuOy:CuC7jj05CUpLhUsj97hM28xmwUuUKkbO
Malware Config
Extracted
bazarloader
167.99.240.197
207.154.236.187
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4612-0-0x00000000025D0000-0x00000000026C2000-memory.dmp BazarLoaderVar6 behavioral2/memory/3044-1-0x0000027E540E0000-0x0000027E541D2000-memory.dmp BazarLoaderVar6 behavioral2/memory/3044-2-0x0000027E540E0000-0x0000027E541D2000-memory.dmp BazarLoaderVar6 behavioral2/memory/4612-3-0x00000000025D0000-0x00000000026C2000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3ffc127bc4ba53142f72726a8773c89a.dll1⤵PID:4612
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ffc127bc4ba53142f72726a8773c89a.dll,DllRegisterServer {2836FE14-B121-4567-B4A1-AA7A6C14A303}1⤵PID:3044
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3044-1-0x0000027E540E0000-0x0000027E541D2000-memory.dmpFilesize
968KB
-
memory/3044-2-0x0000027E540E0000-0x0000027E541D2000-memory.dmpFilesize
968KB
-
memory/4612-0-0x00000000025D0000-0x00000000026C2000-memory.dmpFilesize
968KB
-
memory/4612-3-0x00000000025D0000-0x00000000026C2000-memory.dmpFilesize
968KB