Analysis
-
max time kernel
133s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-01-2024 03:29
Static task
static1
Behavioral task
behavioral1
Sample
7ec459f1295dd0c0fba4279c4a4a3336.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7ec459f1295dd0c0fba4279c4a4a3336.dll
Resource
win10v2004-20231215-en
General
-
Target
7ec459f1295dd0c0fba4279c4a4a3336.dll
-
Size
288KB
-
MD5
7ec459f1295dd0c0fba4279c4a4a3336
-
SHA1
0814acaad186333e3ce126b691d06b57eff62b2d
-
SHA256
acba294d268c0eb1d5275c596f0def1aac68a712afcbe74a7f5cb5a17705befd
-
SHA512
61ecd0fa5900865113516f892a87ab3c7c0c69978201f000687fb8781bd1296a4cb6f0a03434c8fdb6797dd689b9049733af009a30b023f1b15f7c8fe7c5b0bb
-
SSDEEP
3072:p6QlU5T0+vk+wYDgN3XwmbvV4Ynnbe9rhNifQMpnIjZ9jAPUn4CbwKL0Fo3dgqTU:pXEwZSZeKZVA6BNL0F1h31eMgIf1
Malware Config
Extracted
bazarloader
128.199.54.51
161.35.152.204
161.35.95.166
whitestorm9p.bazar
yellowdownpour81.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1088-0-0x0000000001F60000-0x000000000203C000-memory.dmp BazarLoaderVar6 behavioral1/memory/2860-1-0x0000000001CA0000-0x0000000001D7C000-memory.dmp BazarLoaderVar6 behavioral1/memory/2860-2-0x0000000001CA0000-0x0000000001D7C000-memory.dmp BazarLoaderVar6 behavioral1/memory/1088-3-0x0000000001F60000-0x000000000203C000-memory.dmp BazarLoaderVar6
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7ec459f1295dd0c0fba4279c4a4a3336.dll1⤵PID:1088
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ec459f1295dd0c0fba4279c4a4a3336.dll,StartW {E4E6E255-1790-406A-9190-0AD35603ED02}1⤵PID:2860
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1088-0-0x0000000001F60000-0x000000000203C000-memory.dmpFilesize
880KB
-
memory/1088-3-0x0000000001F60000-0x000000000203C000-memory.dmpFilesize
880KB
-
memory/2860-1-0x0000000001CA0000-0x0000000001D7C000-memory.dmpFilesize
880KB
-
memory/2860-2-0x0000000001CA0000-0x0000000001D7C000-memory.dmpFilesize
880KB