Analysis

  • max time kernel
    130s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    11-01-2024 05:24

General

  • Target

    52a68c39a25c1f658fdcd5f4ba151f98.dll

  • Size

    302KB

  • MD5

    52a68c39a25c1f658fdcd5f4ba151f98

  • SHA1

    06c7e71324c4cedffdb31cbe083063104b3b4d88

  • SHA256

    5d89c80df6da1b803dc789e104fd03c022e133c9f8c9ae251a1315309b3a8ffa

  • SHA512

    1c52b3a7a3cb48cc93bca7d84bd8e5171d631a68459f5f99e89e26814d4ec7b5278b21ee11bc8bbcfcb51d1e465d766e8d8873d2c3419f698237601aae7043e4

  • SSDEEP

    6144:Fn2+l1nFgtYyKnXYTOl7Vru9vMt7b+Aw/HrfSMg6Jg:0dKoTm7x4vw7RULf3g6W

Malware Config

Extracted

Family

bazarloader

C2

134.209.196.117

142.93.135.196

m9p.bazar

bluecloud21c.bazar

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

  • Bazar/Team9 Loader payload 4 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\52a68c39a25c1f658fdcd5f4ba151f98.dll
    1⤵
      PID:2304
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\52a68c39a25c1f658fdcd5f4ba151f98.dll,StartW {FB2C31AA-64E6-4672-B659-1A0A229FB8F8}
      1⤵
        PID:2004

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2004-1-0x0000000001BA0000-0x0000000001C7C000-memory.dmp

        Filesize

        880KB

      • memory/2004-2-0x0000000001BA0000-0x0000000001C7C000-memory.dmp

        Filesize

        880KB

      • memory/2304-0-0x0000000001F90000-0x000000000206C000-memory.dmp

        Filesize

        880KB

      • memory/2304-3-0x0000000001F90000-0x000000000206C000-memory.dmp

        Filesize

        880KB