Analysis
-
max time kernel
130s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11-01-2024 05:24
Static task
static1
Behavioral task
behavioral1
Sample
52a68c39a25c1f658fdcd5f4ba151f98.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
52a68c39a25c1f658fdcd5f4ba151f98.dll
Resource
win10v2004-20231215-en
General
-
Target
52a68c39a25c1f658fdcd5f4ba151f98.dll
-
Size
302KB
-
MD5
52a68c39a25c1f658fdcd5f4ba151f98
-
SHA1
06c7e71324c4cedffdb31cbe083063104b3b4d88
-
SHA256
5d89c80df6da1b803dc789e104fd03c022e133c9f8c9ae251a1315309b3a8ffa
-
SHA512
1c52b3a7a3cb48cc93bca7d84bd8e5171d631a68459f5f99e89e26814d4ec7b5278b21ee11bc8bbcfcb51d1e465d766e8d8873d2c3419f698237601aae7043e4
-
SSDEEP
6144:Fn2+l1nFgtYyKnXYTOl7Vru9vMt7b+Aw/HrfSMg6Jg:0dKoTm7x4vw7RULf3g6W
Malware Config
Extracted
bazarloader
134.209.196.117
142.93.135.196
m9p.bazar
bluecloud21c.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2304-0-0x0000000001F90000-0x000000000206C000-memory.dmp BazarLoaderVar6 behavioral1/memory/2004-1-0x0000000001BA0000-0x0000000001C7C000-memory.dmp BazarLoaderVar6 behavioral1/memory/2004-2-0x0000000001BA0000-0x0000000001C7C000-memory.dmp BazarLoaderVar6 behavioral1/memory/2304-3-0x0000000001F90000-0x000000000206C000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\52a68c39a25c1f658fdcd5f4ba151f98.dll1⤵PID:2304
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\52a68c39a25c1f658fdcd5f4ba151f98.dll,StartW {FB2C31AA-64E6-4672-B659-1A0A229FB8F8}1⤵PID:2004