bazarloader | 8f5cae81860564252a76f268555d693b56d3ef96934a5f04caf6b3b367435e1c

Analysis

max time kernel
95s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2024 04:27

Target

9f707b0475bc26052e6361028de31ad1.dll
Size

161KB
MD5

9f707b0475bc26052e6361028de31ad1
SHA1

4245cbfc5ad14874f66cb874408b4db0251167a2
SHA256

8f5cae81860564252a76f268555d693b56d3ef96934a5f04caf6b3b367435e1c
SHA512

8cca3a0ef8ab37592a6f1bc7c577103b41b1574f352bd06d1ace949b5d7fd6ee5e301d0d01e59347c77d1f269ac5f80f9c325262d39a2f521f782a0264db431c
SSDEEP

3072:ii38S9kuloIc4XdL/9AWNCkEON54t6lb+DQReyVIj42UCjUuvu+:P38S97loI9xvPE/6lyDpyVIU24+

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1892-0-0x000002D292C10000-0x000002D292C24000-memory.dmp	BazarLoaderVar6
behavioral2/memory/4512-7-0x000001C7A7BD0000-0x000001C7A7BE4000-memory.dmp	BazarLoaderVar6

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

25 1892 rundll32.exe
54 1892 rundll32.exe

flow	pid	process
25	1892	rundll32.exe
54	1892	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f707b0475bc26052e6361028de31ad1.dll,#1
1⤵
- Blocklisted process makes network request
PID:1892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f707b0475bc26052e6361028de31ad1.dll,#1 2827197084
1⤵
PID:4512

memory/1892-0-0x000002D292C10000-0x000002D292C24000-memory.dmp

Filesize
80KB

Download
memory/4512-7-0x000001C7A7BD0000-0x000001C7A7BE4000-memory.dmp

Filesize
80KB

Download