Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
11-01-2024 21:02
General
-
Target
5492f2a4d4d89b72d9f883886cc3c00c.dll
-
Size
956KB
-
MD5
5492f2a4d4d89b72d9f883886cc3c00c
-
SHA1
e21aa8daad794d9157968bf422f1f3095b89312f
-
SHA256
66ad0c3acba155c5838cc186ea6b74aed5a2f24d68b3a9f735f725b92d7a8d8c
-
SHA512
0bd559a41e8b0dd1f1246b39a1cd8f5fa29fccb441eeebd2816461407fb172c38c34b423133ab0e3808f0b596f85eac2b2c559794c277a4843e5c7ae9e4094c5
-
SSDEEP
12288:cgjcpLmq2lWk8gIFjJyslu0JULFwqrBEtyJIkGkL1QBNeUxLW40T2ee:HjSGl1IFFJ00SBwqV914NroT2L
Score
10/10
Malware Config
Extracted
Family
bazarloader
C2
134.209.196.117
142.93.135.196
whitestorm9p.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5492f2a4d4d89b72d9f883886cc3c00c.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\5492f2a4d4d89b72d9f883886cc3c00c.dll,StartW {7F35D8FE-62D7-4DA6-ADD3-0A5436FD4C17}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB