Overview

overview

10

Static

static

3

8b11a1931b...97.dll

windows7-x64

10

8b11a1931b...97.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    128s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    03-02-2024 01:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8b11a1931bd221bf40a353d62c53cc97.dll

  • Size

    302KB

  • MD5

    8b11a1931bd221bf40a353d62c53cc97

  • SHA1

    deb392ebf5649f894b5d896a8519a185cd85016f

  • SHA256

    4a52de75a024957c941d1652967243de897e359222b3ca369948a6c352fab457

  • SHA512

    3ecdb6d0dc422b6e57691ed35e367349c152f278103eda23fe556daec53fb470ce9ef0205a0ccd022ce9093db73447a128035a87649e2a4aa0f8d3ecc6e03667

  • SSDEEP

    6144:Fn2+l1nFgtYyKnXYTOl7Vru9vMt7b+Aw/HrfSMg6Ja:0dKoTm7x4vw7RULf3g6c

Score
10/10
bazarloaderdropperloader

Malware Config

Extracted

Family

bazarloader

C2

134.209.196.117

142.93.135.196

m9p.bazar

bluecloud21c.bazar

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Bazar/Team9 Loader payload 4 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8b11a1931bd221bf40a353d62c53cc97.dll
    1⤵
      PID:2416
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b11a1931bd221bf40a353d62c53cc97.dll,StartW {0C47720E-312A-4060-A796-67EF228FE6F4}
      1⤵
        PID:2224

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2224-1-0x0000000001DC0000-0x0000000001E9C000-memory.dmp
        Filesize

        880KB

        Download
      • memory/2224-2-0x0000000001DC0000-0x0000000001E9C000-memory.dmp
        Filesize

        880KB

        Download
      • memory/2416-0-0x0000000001CE0000-0x0000000001DBC000-memory.dmp
        Filesize

        880KB

        Download
      • memory/2416-3-0x0000000001CE0000-0x0000000001DBC000-memory.dmp
        Filesize

        880KB

        Download