Overview

overview

10

Static

static

3

8b11a1931b...97.dll

windows7-x64

10

8b11a1931b...97.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-02-2024 01:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8b11a1931bd221bf40a353d62c53cc97.dll

  • Size

    302KB

  • MD5

    8b11a1931bd221bf40a353d62c53cc97

  • SHA1

    deb392ebf5649f894b5d896a8519a185cd85016f

  • SHA256

    4a52de75a024957c941d1652967243de897e359222b3ca369948a6c352fab457

  • SHA512

    3ecdb6d0dc422b6e57691ed35e367349c152f278103eda23fe556daec53fb470ce9ef0205a0ccd022ce9093db73447a128035a87649e2a4aa0f8d3ecc6e03667

  • SSDEEP

    6144:Fn2+l1nFgtYyKnXYTOl7Vru9vMt7b+Aw/HrfSMg6Ja:0dKoTm7x4vw7RULf3g6c

Score
10/10
bazarloaderdropperloader

Malware Config

Extracted

Family

bazarloader

C2

134.209.196.117

142.93.135.196

m9p.bazar

bluecloud21c.bazar

Signatures

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

    loaderdropperbazarloader
  • Bazar/Team9 Loader payload 4 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8b11a1931bd221bf40a353d62c53cc97.dll
    1⤵
      PID:4024
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b11a1931bd221bf40a353d62c53cc97.dll,StartW {ACE38742-E973-4624-BD25-D1D4F6494E66}
      1⤵
        PID:1840

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1840-1-0x00000171F17B0000-0x00000171F188C000-memory.dmp
        Filesize

        880KB

        Download
      • memory/1840-2-0x00000171F17B0000-0x00000171F188C000-memory.dmp
        Filesize

        880KB

        Download
      • memory/4024-0-0x0000000001F00000-0x0000000001FDC000-memory.dmp
        Filesize

        880KB

        Download
      • memory/4024-3-0x0000000001F00000-0x0000000001FDC000-memory.dmp
        Filesize

        880KB

        Download