bazarloader | 069488d1794422c5cdcb973aca706496e710e8eaa9cddafbe8ced4e406e8a334

Analysis

max time kernel
128s
max time network
130s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 14:14

Target

ac13ed572d80bc4500ea3f7b9298f910.dll
Size

248KB
MD5

ac13ed572d80bc4500ea3f7b9298f910
SHA1

759ec33cd4556315b8f8f230ad95cc4d971b9143
SHA256

069488d1794422c5cdcb973aca706496e710e8eaa9cddafbe8ced4e406e8a334
SHA512

87f9a3c9173c70c961b6c1e8cc97b2285edb264cf0bc7344c83f95662b2b1dde35a65d01e87033a87edb9466678ba3b09fcf396e29cc6da985c9f238ddeb34a7
SSDEEP

3072:5VqfK66P8XNbzxYa0sJwoNp1e7Rdre5gTrnPlS6y1ZAn0Pe1k5c9azS+6IHEGABC:EVbzxYy7oDy5gQ6yMnKqJPoeGTj

Score

10^/10

Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
loader dropper bazarloader

Bazar/Team9 Loader payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1248-0-0x0000000001EE0000-0x0000000002077000-memory.dmp	BazarLoaderVar6
behavioral1/memory/2628-1-0x0000000001F00000-0x0000000002097000-memory.dmp	BazarLoaderVar6
behavioral1/memory/2628-2-0x0000000001F00000-0x0000000002097000-memory.dmp	BazarLoaderVar6
behavioral1/memory/1248-3-0x0000000001EE0000-0x0000000002077000-memory.dmp	BazarLoaderVar6

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac13ed572d80bc4500ea3f7b9298f910.dll
1⤵
PID:1248

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac13ed572d80bc4500ea3f7b9298f910.dll,StartW 2260236355
1⤵
PID:2628

memory/1248-0-0x0000000001EE0000-0x0000000002077000-memory.dmp

Filesize
1.6MB

Download
memory/1248-3-0x0000000001EE0000-0x0000000002077000-memory.dmp

Filesize
1.6MB

Download
memory/2628-1-0x0000000001F00000-0x0000000002097000-memory.dmp

Filesize
1.6MB

Download
memory/2628-2-0x0000000001F00000-0x0000000002097000-memory.dmp

Filesize
1.6MB

Download