Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
26/02/2024, 18:42
General
- Target a7108c4fac33325f45e921b9a38911a2.dll
- Size 164KB
- Sample240226-xcqflsda77
- SHA256 072b5745ec0923ff13ee4f28ea5559b8b8b404ab123bc4e5efef2c3aeac687d5
Score
10/10
Malware Config
Extracted
Family
-
bazarloader
C2
-
167.99.240.197
-
207.154.236.187
Signatures
- Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
- Bazar/Team9 Loader payload 4 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a7108c4fac33325f45e921b9a38911a2.dll1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7108c4fac33325f45e921b9a38911a2.dll,DllRegisterServer {54C361DD-40DA-464B-AA09-6A95A3E91D78}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4296-0-0x0000000002D70000-0x0000000002E62000-memory.dmp
memory/4296-3-0x0000000002D70000-0x0000000002E62000-memory.dmp
memory/4824-1-0x000002544F980000-0x000002544FA72000-memory.dmp
memory/4824-2-0x000002544F980000-0x000002544FA72000-memory.dmp