Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10-01-2024 06:29
Static task
static1
Behavioral task
behavioral1
Sample
4fd5679a0c8bb691460d2f21b6bf95fd.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4fd5679a0c8bb691460d2f21b6bf95fd.dll
Resource
win10v2004-20231215-en
General
-
Target
4fd5679a0c8bb691460d2f21b6bf95fd.dll
-
Size
288KB
-
MD5
4fd5679a0c8bb691460d2f21b6bf95fd
-
SHA1
3445ed787e6e03184a74b7d9a293f898768ac688
-
SHA256
22498b7c26cdac972970888ee454f331b74a96977478abf0ad85a0e6c9f8bb53
-
SHA512
702860ccc1931f0c3d103ac739bf294050f9839118b09173806cf8d74e4970224bfdfeb8a636c07be114944fa8969c179defcb5a1f009493a68c01cb7fca3317
-
SSDEEP
3072:p6QlU5T0+vk+wYDgN3XwmbvV4Ynnbe9rhNifQMpnIjZ9jAPUn4CbwKL0Fo3dgqTy:pXEwZSZeKZVA6BNL0F1h31eMgIf/
Malware Config
Extracted
bazarloader
128.199.54.51
161.35.152.204
161.35.95.166
whitestorm9p.bazar
yellowdownpour81.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2028-0-0x0000000001D50000-0x0000000001E2C000-memory.dmp BazarLoaderVar6 behavioral1/memory/2436-1-0x0000000000480000-0x000000000055C000-memory.dmp BazarLoaderVar6 behavioral1/memory/2436-2-0x0000000000480000-0x000000000055C000-memory.dmp BazarLoaderVar6 behavioral1/memory/2028-3-0x0000000001D50000-0x0000000001E2C000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4fd5679a0c8bb691460d2f21b6bf95fd.dll1⤵PID:2028
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fd5679a0c8bb691460d2f21b6bf95fd.dll,StartW {50EC7656-F013-4E66-9A57-D4586E3EB99D}1⤵PID:2436
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2028-0-0x0000000001D50000-0x0000000001E2C000-memory.dmpFilesize
880KB
-
memory/2028-3-0x0000000001D50000-0x0000000001E2C000-memory.dmpFilesize
880KB
-
memory/2436-1-0x0000000000480000-0x000000000055C000-memory.dmpFilesize
880KB
-
memory/2436-2-0x0000000000480000-0x000000000055C000-memory.dmpFilesize
880KB