Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18-01-2024 19:36
Static task
static1
Behavioral task
behavioral1
Sample
65dcb5a54a74368bddc0701fc8671200.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
65dcb5a54a74368bddc0701fc8671200.dll
Resource
win10v2004-20231215-en
General
-
Target
65dcb5a54a74368bddc0701fc8671200.dll
-
Size
1.1MB
-
MD5
65dcb5a54a74368bddc0701fc8671200
-
SHA1
64aaa5e1e7e8d1de79d5b7a9afb8a95860e8fd8a
-
SHA256
d38427202dfbc619de931eb96038ef66820703a0b64d50dd052646ea8ab0fe89
-
SHA512
88f1e81dab33f4e66816c55c5bd9609b5cdc638d8a8139e1a2151519a02cd4fa281a0c8f7b824ddc08f49b3e868d00c574ab04599cd140c681216f666ee12eeb
-
SSDEEP
12288:FkcwMgrI3Nf+aQY5HAu+U2Brko9dHg4MtVXoKpma0S8dCaBSPZC1XZ1elHVx:Gcw02cARUUAgCoK2S8IyXfu1x
Malware Config
Extracted
bazarloader
greencloud46a.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4816-0-0x00000000275E0000-0x00000000275F4000-memory.dmp BazarLoaderVar6 behavioral2/memory/3540-2-0x0000019976BE0000-0x0000019976BF4000-memory.dmp BazarLoaderVar6 behavioral2/memory/4816-1-0x00007FFC47430000-0x00007FFC4758D000-memory.dmp BazarLoaderVar6 behavioral2/memory/3540-3-0x00007FFC47430000-0x00007FFC4758D000-memory.dmp BazarLoaderVar6 behavioral2/memory/3540-4-0x0000019976BE0000-0x0000019976BF4000-memory.dmp BazarLoaderVar6 behavioral2/memory/4816-6-0x00000000275E0000-0x00000000275F4000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\65dcb5a54a74368bddc0701fc8671200.dll1⤵PID:4816
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\65dcb5a54a74368bddc0701fc8671200.dll,StartW 3360350201⤵PID:3540
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3540-2-0x0000019976BE0000-0x0000019976BF4000-memory.dmpFilesize
80KB
-
memory/3540-3-0x00007FFC47430000-0x00007FFC4758D000-memory.dmpFilesize
1.4MB
-
memory/3540-4-0x0000019976BE0000-0x0000019976BF4000-memory.dmpFilesize
80KB
-
memory/4816-0-0x00000000275E0000-0x00000000275F4000-memory.dmpFilesize
80KB
-
memory/4816-1-0x00007FFC47430000-0x00007FFC4758D000-memory.dmpFilesize
1.4MB
-
memory/4816-6-0x00000000275E0000-0x00000000275F4000-memory.dmpFilesize
80KB