Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08-01-2024 23:20
Static task
static1
Behavioral task
behavioral1
Sample
4cb7c422412f1f4e591131daa9880a26.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4cb7c422412f1f4e591131daa9880a26.dll
Resource
win10v2004-20231222-en
General
-
Target
4cb7c422412f1f4e591131daa9880a26.dll
-
Size
164KB
-
MD5
4cb7c422412f1f4e591131daa9880a26
-
SHA1
000d0c4e351f2f8a3fc81297654b7eaf7b911d63
-
SHA256
fd40842a94095812643f3fa2c5634ce75c2c6139689d7549a5d74a4b253eb047
-
SHA512
183cc28bd5fc1e33bf708fff81dafc0c982397b3b89425231bbddfe1696d3ee99a1ce0c70b30383315ed7ad20b3918932e1bed65ed9abd4f30a1a3a001dd1fce
-
SSDEEP
3072:cTltpXTmRUD82PbjCb5lcUpLhUf05x97bsqWpaM0fB8U6xcBwVSuU1E7YbqnOuOi:CuC7jj05CUpLhUsj97hM28xmwUuUKkbm
Malware Config
Extracted
bazarloader
167.99.240.197
207.154.236.187
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-0-0x0000000001FC0000-0x00000000020B2000-memory.dmp BazarLoaderVar6 behavioral1/memory/3048-1-0x0000000001DC0000-0x0000000001EB2000-memory.dmp BazarLoaderVar6 behavioral1/memory/3048-2-0x0000000001DC0000-0x0000000001EB2000-memory.dmp BazarLoaderVar6 behavioral1/memory/2372-3-0x0000000001FC0000-0x00000000020B2000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4cb7c422412f1f4e591131daa9880a26.dll1⤵PID:2372
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cb7c422412f1f4e591131daa9880a26.dll,DllRegisterServer {69EC4CA0-CA0D-4FE0-8583-51566626E0F9}1⤵PID:3048
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2372-0-0x0000000001FC0000-0x00000000020B2000-memory.dmpFilesize
968KB
-
memory/2372-3-0x0000000001FC0000-0x00000000020B2000-memory.dmpFilesize
968KB
-
memory/3048-1-0x0000000001DC0000-0x0000000001EB2000-memory.dmpFilesize
968KB
-
memory/3048-2-0x0000000001DC0000-0x0000000001EB2000-memory.dmpFilesize
968KB