Analysis
-
max time kernel
128s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
03-02-2024 01:44
General
-
Target
8b11a1931bd221bf40a353d62c53cc97.dll
-
Size
302KB
-
MD5
8b11a1931bd221bf40a353d62c53cc97
-
SHA1
deb392ebf5649f894b5d896a8519a185cd85016f
-
SHA256
4a52de75a024957c941d1652967243de897e359222b3ca369948a6c352fab457
-
SHA512
3ecdb6d0dc422b6e57691ed35e367349c152f278103eda23fe556daec53fb470ce9ef0205a0ccd022ce9093db73447a128035a87649e2a4aa0f8d3ecc6e03667
-
SSDEEP
6144:Fn2+l1nFgtYyKnXYTOl7Vru9vMt7b+Aw/HrfSMg6Ja:0dKoTm7x4vw7RULf3g6c
Score
10/10
Malware Config
Extracted
Family
bazarloader
C2
134.209.196.117
142.93.135.196
m9p.bazar
bluecloud21c.bazar
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 4 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8b11a1931bd221bf40a353d62c53cc97.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b11a1931bd221bf40a353d62c53cc97.dll,StartW {0C47720E-312A-4060-A796-67EF228FE6F4}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
880KB