bazarloader | 8f5cae81860564252a76f268555d693b56d3ef96934a5f04caf6b3b367435e1c

Analysis

max time kernel
126s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
16-02-2024 04:27

Target

9f707b0475bc26052e6361028de31ad1.dll
Size

161KB
MD5

9f707b0475bc26052e6361028de31ad1
SHA1

4245cbfc5ad14874f66cb874408b4db0251167a2
SHA256

8f5cae81860564252a76f268555d693b56d3ef96934a5f04caf6b3b367435e1c
SHA512

8cca3a0ef8ab37592a6f1bc7c577103b41b1574f352bd06d1ace949b5d7fd6ee5e301d0d01e59347c77d1f269ac5f80f9c325262d39a2f521f782a0264db431c
SSDEEP

3072:ii38S9kuloIc4XdL/9AWNCkEON54t6lb+DQReyVIj42UCjUuvu+:P38S97loI9xvPE/6lyDpyVIU24+

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1200-0-0x00000000002D0000-0x00000000002E4000-memory.dmp	BazarLoaderVar6
behavioral1/memory/2836-7-0x00000000003C0000-0x00000000003D4000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

3 1200 rundll32.exe
8 1200 rundll32.exe
9 1200 rundll32.exe
10 1200 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f707b0475bc26052e6361028de31ad1.dll,#1
1⤵
- Blocklisted process makes network request
PID:1200

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f707b0475bc26052e6361028de31ad1.dll,#1 3990571922
1⤵
PID:2836

memory/1200-0-0x00000000002D0000-0x00000000002E4000-memory.dmp

Filesize
80KB

Download
memory/2836-7-0x00000000003C0000-0x00000000003D4000-memory.dmp

Filesize
80KB

Download