Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08-01-2024 23:20
Static task
static1
Behavioral task
behavioral1
Sample
4cb7c422412f1f4e591131daa9880a26.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4cb7c422412f1f4e591131daa9880a26.dll
Resource
win10v2004-20231222-en
General
-
Target
4cb7c422412f1f4e591131daa9880a26.dll
-
Size
164KB
-
MD5
4cb7c422412f1f4e591131daa9880a26
-
SHA1
000d0c4e351f2f8a3fc81297654b7eaf7b911d63
-
SHA256
fd40842a94095812643f3fa2c5634ce75c2c6139689d7549a5d74a4b253eb047
-
SHA512
183cc28bd5fc1e33bf708fff81dafc0c982397b3b89425231bbddfe1696d3ee99a1ce0c70b30383315ed7ad20b3918932e1bed65ed9abd4f30a1a3a001dd1fce
-
SSDEEP
3072:cTltpXTmRUD82PbjCb5lcUpLhUf05x97bsqWpaM0fB8U6xcBwVSuU1E7YbqnOuOi:CuC7jj05CUpLhUsj97hM28xmwUuUKkbm
Malware Config
Extracted
bazarloader
167.99.240.197
207.154.236.187
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/812-0-0x00000000025A0000-0x0000000002692000-memory.dmp BazarLoaderVar6 behavioral2/memory/1744-1-0x00000187FDD80000-0x00000187FDE72000-memory.dmp BazarLoaderVar6 behavioral2/memory/1744-2-0x00000187FDD80000-0x00000187FDE72000-memory.dmp BazarLoaderVar6 behavioral2/memory/812-3-0x00000000025A0000-0x0000000002692000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4cb7c422412f1f4e591131daa9880a26.dll1⤵PID:812
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cb7c422412f1f4e591131daa9880a26.dll,DllRegisterServer {4D267BF8-F357-4758-8340-50885781D2DE}1⤵PID:1744
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/812-0-0x00000000025A0000-0x0000000002692000-memory.dmpFilesize
968KB
-
memory/812-3-0x00000000025A0000-0x0000000002692000-memory.dmpFilesize
968KB
-
memory/1744-1-0x00000187FDD80000-0x00000187FDE72000-memory.dmpFilesize
968KB
-
memory/1744-2-0x00000187FDD80000-0x00000187FDE72000-memory.dmpFilesize
968KB